Staff

Technical Tip: How to download and install a hotfix or a patch on FortiClient EMS in emscli

Forum|Forum|27 days ago
August 11, 2026
0 replies
97 views

Description

This article describes the sequence of CLI commands in order to download and install a hotfix on FortiClient EMS when only emscli commands are available.

Scope

FortiClient EMS on Linux VM (emscli only).

Solution

First, before any hotfix application, backup the FortiClient EMS by following instructions in this article: Technical Tip: EMS Database Backup and Restore using EMSCLI.

Download the hotfix provided by Fortinet Support. Note: See the 'Related articles' section for specific CVE fix downloads.
Store it on a SCP server reachable from the EMS: e.g. 10.5.0.1 in the '/home/fctems/' directory.

In this example, assume that the hotfix hotfix_1321051.zip needs to be installed on the FortiClient EMS.

Log in using a SSH client on the FortiClient EMS with an appropriate administrator account.
Download the hotfix locally on FortiClient EMS using the following command:

$> execute <server type> –-read –-remote.ip <IP> –-remote.user <username> -–remote.file "<remote file path>" –-local.file "<local file path>"

Important: The --read option is used to download the file locally (and not upload).

ems@ems.local $> execute scp --read --remote.user fctems --remote.ip 10.5.0.1 --remote.file /home/fctems/hotfix_1321051.zip --local.file hotfix_1321051.zip
fctems@10.5.0.1's password:
Connectivity test using service 'scp' to remote host 10.5.0.1 with user fctems for reading file /home/fctems/hotfix_1321051.zip passed !
File /home/fctems/hotfix_1321051.zip:10.5.0.1 successfully copied to /exchange/hotfix_1321051.zip

List the downloaded file in the local folder (The '/exchange' folder is the default folder):

ems@ems.local $> execute ls
/var/lib/redis:
total 164K
-rw-rw---- 1 redis redis 161K Aug 11 07:50 dump.rdb
/exchange:
total 30M
-rw-r--r-- 1 root root  30M Jul 28 13:00 emsdb_2026-07-28_13-00-01.dbbackup.db.enc
-rw-r--r-- 1 root root  84K Aug  5 16:53 forticlientems-install-20260805164408.log
-rw-r--r-- 1 root root 5.3K Aug 11 07:54 hotfix_1321051.zip
ems@ems.local $>

Before installing a new one, list the current hotfixes installed:

ems@ems.local $> execute hotfix --list
2026/08/11 07:58:41 FortiClient EMS Hotfixer - 7.4.8.2245
2026/08/11 07:58:41 bye!
ems@ems.local $>

Follow these instructions to install the downloaded hotfix: Installing an EMS hotfix.

ems@ems.local $> execute hotfix --apply hotfix_1321051.zip
2026/08/11 08:12:04 FortiClient EMS Hotfixer - 7.4.8.2245
2026/08/11 08:12:04 Will load hotfix [/home/ems/exchange/hotfix_1321051.zip]
2026/08/11 08:12:04 Patch has check sum: 1d7a1ca2830779721fa381dfc4339762
...snip...
2026/08/11 08:12:23 starting service [fcems_monitor]
2026/08/11 08:12:23 bye!
ems@ems.local $>

Option: Check the latest upgrades or hotfixes application logs by following the steps in this article: Technical Tip: How to display logs and check an hotfix application on FortiClient EMS in emscli.

ems@ems.local $> execute ls /var/log/forticlientems/upg*
-rw-r--r-- 1 root root 583 Aug  7 18:00 /var/log/forticlientems/upgradeworker_2026-07-28.log.gz

If the listed file is a .log file, the content can be displayed immediately:

ems@ems.local $> execute cat /var/log/forticlientems/<latest upgradeworker log file>

If the listed file is not a .log file but .log.gz file, upload it on the SCP server to further download it on a workstation and unzip it before displaying the content.

ems@ems.local $> execute copyfile --from  /var/log/forticlientems/upgradeworker_2026-07-28.log.gz --to /exchange/upgradeworker_2026-07-28.log.gz
File copied.
ems@ems.local $> execute ls
/exchange:
total 30M
-rw-r--r-- 1 root root  30M Jul 28 13:00 emsdb_2026-07-28_13-00-01.dbbackup.db.enc
-rw-r--r-- 1 root root  84K Aug  5 16:53 forticlientems-install-20260805164408.log
-rw-r--r-- 1 root root 5.3K Aug 11 07:54 hotfix_1321051.zip
-rw-r--r-- 1 root root  583 Aug 11 08:22 upgradeworker_2026-07-28.log.gz
/var/lib/redis:
total 164K
-rw-rw---- 1 redis redis 162K Aug 11 08:22 dump.rdb
ems@ems.local $> execute scp --remote.user fctems --remote.ip 10.5.0.1 --local.file upgradeworker_2026-07-28.log.gz --remote.file upgradeworker_2026-07-28.log.gz
fctems@10.5.0.1's password:
Connectivity test using service 'scp' to remote host 10.5.0.1 with user fctems for writing file upgradeworker_2026-07-28.log.gz passed !
File /exchange/upgradeworker_2026-07-28.log.gz successfully copied to 10.5.0.1:upgradeworker_2026-07-28.log.gz
ems@ems.local $>

Finally, list the applied patches/hotfixes again:

 ems@emskasi.sec $> execute hotfix --list
2026/08/11 10:20:27 FortiClient EMS Hotfixer - 7.4.8.2245
Patch: 1d7a1ca2830779721fa381dfc4339762 ID:     Status:applied  Date:2026-08-11 08:12:23.136137298 +0000 UTC m=+18.527949853    Description:Hotfix: Mantis: 1321051
        Versions:8.0.1,8.0.0,7.4.9,7.4.8,7.4.7,7.4.6,7.4.5
2026/08/11 10:20:27 bye!
ems@emskasi.sec $>

Related articles: