Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks
Critical FortiClient EMS zero-day (CVE-2026-35616) exploited post-patch to deploy EKZ Infostealer malware.
Run Fortinet?
Get an email when a reviewed story names Fortinet, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Fortinet patched a critical remote code execution vulnerability (CVE-2026-35616, CVSS 9.1) in FortiClient Endpoint Management Server in April after it was exploited as a zero-day. Arctic Wolf reports fresh attacks targeting unpatched deployments, using the vulnerability to distribute EKZ Infostealer malware disguised as fake Fortinet patches via FortiClient's VPN scripting workflows. The malware harvests credentials and cookies from major browsers, with attackers leveraging FortiClient's management pathway to execute PowerShell commands across all managed endpoints.
The lesson from this incident
Full lessonAttackers are actively exploiting a critical remote code execution vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server that was patched by Fortinet in April. The vulnerability allows attackers to distribute EKZ Infostealer malware disguised as fake Fortinet patches, leveraging the management server's legitimate VPN scripting workflows to execute PowerShell commands across all managed endpoints. This incident demonstrates how unpatched critical vulnerabilities in management infrastructure can provide attackers with broad access to steal credentials and compromise entire endpoint fleets. Organizations running FortiClient EMS must prioritize immediate patching as attackers are weaponizing the management pathway to turn security tools against the networks they're meant to protect.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
- cve — CVE-2026-35616
- malware — EKZ Infostealer