# Unpatched FortiClient EMS Servers Under Active Attack: Critical RCE Vulnerability Weaponized for Credential Theft


## The Threat


A critical remote code execution vulnerability in Fortinet's FortiClient Endpoint Management Server (EMS) continues to be actively exploited months after patches were released, according to fresh research from Arctic Wolf. The flaw, tracked as CVE-2026-35616, allows unauthenticated attackers to execute arbitrary code on the central management platform—and because FortiClient EMS controls policies, configurations, and endpoint deployments across entire organizations, a single compromised server becomes a beachhead to every managed device.


The vulnerability is particularly insidious because it requires no authentication, meaning attackers can target FortiClient EMS instances directly from the internet without needing valid credentials or multi-factor authentication to bypass. This low barrier to exploitation, combined with the platform's privileged position within enterprise networks, has made it an attractive target for threat actors looking to gain persistent access to large numbers of machines at once.


What makes the current wave of attacks especially concerning is the sophistication of the payload. Rather than deploying generic malware, attackers are using FortiClient's own legitimate management pathways to distribute the EKZ Infostealer—a credential-stealing malware disguised as a routine Fortinet endpoint patch. The malware is executed through FortiClient's scripting workflows, invoking PowerShell commands in a manner that mimics legitimate administrative operations, making detection through traditional endpoint monitoring significantly harder.


## Severity and Impact


| Field | Value |

|-------|-------|

| CVE Identifier | CVE-2026-35616 |

| CVSS v3.1 Score | 9.1 (Critical) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Changed |

| Authentication Required | No |

| CISA KEV List Added | April 6, 2026 |

| Initial Patch Release | Early April 2026 |

| Exploitation Status | Active, in-the-wild exploitation confirmed |


## Affected Products


Fortinet FortiClient Endpoint Management Server (EMS):

  • All versions prior to the April 2026 hotfix
  • Specific patched versions: consult Fortinet's security advisory for exact version numbers

    • Organizations running FortiClient EMS as a centralized management platform for endpoint security policies, VPN configurations, and device management are at risk if they have not applied the April patches.


    ## Mitigations


    Immediate Actions:

  • Apply Fortinet patches immediately. Organizations should treat this as a critical priority and deploy the April 2026 hotfix or later without delay. FortiClient EMS instances exposed to the internet are particularly vulnerable.
  • Assume compromise and conduct forensic analysis. Any FortiClient EMS server that was unpatched during the exploit window should be considered potentially compromised. Review logs for suspicious administrative activities, unusual PowerShell execution, and any management commands that did not originate from known administrators.
  • Isolate and re-image endpoints if compromise is suspected. Because the vulnerability allows code execution on all managed endpoints, a single compromised FortiClient EMS server could mean widespread endpoint compromise. Consider re-imaging critical systems if you cannot rule out malware deployment.

    • Containment and Detection:

  • Segment FortiClient EMS from direct internet access. Place the management server behind a firewall or VPN gateway that restricts access to known administrative IP ranges only.
  • Monitor FortiClient scripting and PowerShell execution. Enable logging and alerting on FortiClient-managed PowerShell execution, particularly any commands invoked through management workflows that were not scheduled by your administration team.
  • Hunt for EKZ Infostealer indicators. The malware specifically targets Chrome, Microsoft Edge, Firefox, and other Chromium and Gecko-based browsers for credential and cookie theft. Check for suspicious processes accessing browser credential stores or unusual file writes to temporary directories.
  • Implement network-based detection. Monitor outbound HTTP traffic from endpoints for connections to known malware command-and-control infrastructure. Arctic Wolf identified exfiltration over unencrypted HTTP, making it detectable with proper network monitoring.

    • Long-Term Hardening:

  • Credential rotation for all systems accessed from potentially compromised endpoints. If your incident response determines that the infostealer was deployed, rotate credentials for accounts that may have been accessed from affected machines, particularly accounts with elevated privileges.
  • Enable FortiClient's security features. Ensure that endpoint detection and response (EDR) features, advanced threat protection, and behavior-based detection are fully enabled on all managed endpoints to catch similar attacks in the future.

    • ## References


  • Fortinet Security Advisory: https://www.fortinet.com/psirt
  • CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities
  • Arctic Wolf Research: Contact Arctic Wolf Labs for full technical analysis
  • National Vulnerability Database (NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-35616

    • ---


    ## HackWire Analysis


    This incident is a textbook example of why patch windows matter in enterprise security. Fortinet released hotfixes in early April, and we're now in late May—nearly two months later—with fresh reports of active exploitation. This suggests that a significant portion of FortiClient EMS deployments remain unpatched despite a CISA critical warning and public disclosure of zero-day exploitation.


    The sophistication angle here deserves attention. Threat actors aren't just using a known vulnerability to drop generic commodity malware; they're weaponizing FortiClient's own management infrastructure to make attacks blend in with legitimate administrative traffic. This is a marked escalation from simple exploitation and points to either a well-resourced threat actor group or a toolset that has been refined through repeated campaigns. The use of a disguised "patch" as the delivery mechanism shows understanding of enterprise patch management workflows—defenders tend to trust packages that appear to come from trusted vendors.


    What's particularly dangerous is the scope of blast radius. FortiClient EMS is designed to be a single point of control for potentially thousands of endpoints. In the hands of an attacker, a compromised EMS server becomes a botnet command center without needing to distribute malware itself—the organization's own management tools do the work. The information stealer harvests credentials from browsers, which is a proven first step for lateral movement and persistent access to high-value systems.


    The credential exfiltration over unencrypted HTTP is noteworthy too. Arctic Wolf's observation that "the application does not possess network-based credentials exfiltration capabilities" suggests this is either an older variant of the EKZ infostealer or one deliberately configured for stealth—attackers are aware that encrypted C2 channels draw more scrutiny. For defenders, this actually creates an opportunity: monitoring for unencrypted HTTP exfiltration from endpoints that shouldn't be making such calls can be an effective detection mechanism.


    For organizations with FortiClient EMS deployed, the message is clear: patch now, hunt immediately if you can't prove continuous patching during the exploit window, and reconsider whether critical infrastructure management tools should ever face the internet directly. This is exactly the kind of vulnerability that justifies air-gapping sensitive administrative infrastructure.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)