Threat Actors Exploit Critical Forti Client EMS Flaw to Deploy Credential Stealer

Summary: Threat actors exploited CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS with a CVSS score of 9.1, to deliver a credential stealer called EKZ Infostealer, according to Arctic Wolf, which observed the activity in May 2026. The attackers disguised the payload as a Fortinet endpoint update, used FortiClient's own management pathway to push PowerShell commands to managed endpoints, and exfiltrated stolen browser data to 83.138.53[.]110 via HTTP POST.
Bottom line: Once attackers could modify EMS-managed configuration, every managed endpoint became a potential execution target without a separate intrusion path to each device. The harvested session cookies and saved credentials can give attackers follow-on access to cloud services and internal applications, including cases where session reuse circumvents MFA prompts.

Read the original at The Hacker News ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2026-35616
Related: ⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More Cyber Risks ·
At The Edge Clear: April 06 - 13, 2026 Cyber Risks ·
CVE-2026-35616: Fortinet Forti Client EMS Improper Access Control Vulnerability Known Exploited Vulnerabilities · Apr 06, 2026