Fortinet (FTNT) is down about 4.31% in Thursday trading (April 23, 2026), with the decline tied to continued investor sensitivity around Fortinet product-security headlines after disclosure of an actively exploited FortiClient Enterprise Management Server (EMS) vulnerability tracked as CVE-2026-35616. The issue has been widely circulated through vulnerability trackers and security research writeups, reinforcing a near-term “headline risk” overhang even after hotfix availability.

CVE-2026-35616 has been described as a critical FortiClient EMS issue with active exploitation, pushing organizations toward immediate remediation. Security research summaries note Fortinet released out-of-band hotfixes for affected FortiClient EMS versions and urged rapid deployment, while national vulnerability infrastructure entries link back to Fortinet’s own PSIRT materials. The combination of “actively exploited” language and patch urgency can weigh on sentiment for security vendors because it raises concerns about customer emergency response cycles, support burden, and reputational impact.

Traders will watch for signs the vulnerability story is extending—such as follow-on government alerts, additional related CVEs being emphasized in exploited-vulnerability catalogs, or a broader risk-off tape in cybersecurity shares. On the company side, the key swing factor is whether the incident remains a contained patch-and-move-on event or becomes a recurring headline that influences procurement timelines, renewals, and competitive positioning over the next few weeks.