Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks
A critical FortiClient Endpoint Management Server (EMS) vulnerability patched in April has been exploited in fresh attacks to deploy information-stealing malware, Arctic Wolf reports.
The flaw, tracked as CVE-2026-35616 (CVSS score of 9.1), can be exploited remotely via crafted requests for remote code execution (RCE) and does not require authentication.
Fortinet rolled out hotfixes for the security defect in early April, warning that it had been exploited in the wild as a zero-day and urging immediate patching.
Unpatched FortiClient EMS deployments are now being targeted in a campaign deploying the EKZ Infostealer disguised as a fake Fortinet endpoint patch.
The payload was executed via FortiClient-managed VPN scripting workflows, using command scripts that invoked PowerShell, suggesting knowledge of the affected environment.
“The observed execution pattern suggests that threat actors used FortiClient’s own management pathway to push malicious PowerShell commands to managed endpoints in a way that resembled legitimate management operations,” Arctic...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
