# Critical FortiClient EMS Flaw Weaponized to Deploy Credential Stealer Across Enterprise Endpoints


## The Threat


Threat actors are actively exploiting CVE-2026-35616, a critical vulnerability in Fortinet's FortiClient Endpoint Management Server (EMS), to compromise managed endpoints at scale and harvest sensitive credentials. The flaw—a pre-authentication API access bypass that leads to privilege escalation—allows attackers to bypass normal authentication controls and manipulate endpoint management configurations without authorization. Once exploited, the vulnerability transforms the trusted EMS infrastructure itself into a weapon, enabling attackers to push malicious code directly to every device under management.


According to threat intelligence from Arctic Wolf, the attack chain is sophisticated and deliberately designed to masquerade as legitimate administrative activity. After gaining unauthorized access to the EMS via the API bypass, threat actors modify management configurations to suppress firmware update notifications, then inject malicious PowerShell scripts into endpoint policies. These scripts are delivered through the same trusted communication channel that organizations rely on for legitimate endpoint management, making detection significantly harder. The malicious payload—a custom Windows information stealer named "FortiEndpoint_Patch.exe"—is packaged to look like a routine Fortinet security update, leveraging the illegitimate Fortinet executable "fortitray.exe" to execute with minimal user friction.


The scope of compromise is particularly alarming: once EMS is compromised, every endpoint connected to that management server becomes a potential target for code execution without requiring separate intrusion paths to individual machines. This centralized attack surface represents a fundamental risk in endpoint management architectures—the very infrastructure designed to protect and administer endpoints becomes the vector for mass compromise.


## Severity and Impact


| Attribute | Details |

|-----------|---------|

| CVE ID | CVE-2026-35616 |

| CVSS Score | 9.1 (Critical) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |

| Attack Vector | Network |

| Attack Complexity | Low |

| Privileges Required | None (pre-authentication) |

| User Interaction | None |

| CWE | CWE-285 (Improper Authorization) |

| Patch Version | FortiClient EMS 7.4.7 and later |


## Affected Products


  • FortiClient EMS versions prior to 7.4.7

    • - FortiClient EMS 7.4.6 and earlier

    - FortiClient EMS 7.2.x (all versions)

    - FortiClient EMS 7.0.x (all versions)


    Organizations running any FortiClient EMS deployment on versions before 7.4.7 are vulnerable to unauthenticated exploitation.


    ## Mitigations


    Immediate Actions:

  • Upgrade FortiClient EMS to version 7.4.7 or later without delay. This patch is critical and should be prioritized as a security emergency.
  • Review EMS administrative logs for signs of unauthorized API access, particularly any modifications to endpoint policies, firmware configurations, or scheduled scripts.
  • Check managed endpoints for the presence of "FortiEndpoint_Patch.exe" or suspicious PowerShell execution history.

    • Detection and Monitoring:

  • Monitor for unexpected endpoint policy changes, especially those involving script injection or PowerShell execution.
  • Alert on any modifications to firmware upgrade reminder settings—threat actors deliberately suppress these to avoid user awareness.
  • Search network logs for HTTP POST requests to external IP 83.138.53[.]110 or similar patterns indicating data exfiltration.
  • Review FortiClient event logs for execution of non-standard or unsigned scripts through the management interface.

    • Defensive Hardening:

  • Implement network segmentation to isolate EMS infrastructure and limit its ability to communicate laterally if compromised.
  • Restrict API access to EMS through IP whitelisting and require certificate-based authentication where available.
  • Apply principle of least privilege to EMS administrative accounts; use multi-factor authentication and audit all privileged API calls.
  • Monitor browser credential storage on endpoints (Chrome, Firefox, Edge) for unexpected access or exfiltration.

    • Post-Compromise Response:

  • If compromise is suspected, immediately reset credentials for any accounts with access to cloud services, internal applications, or systems that were used on affected endpoints.
  • Be aware that stolen session cookies may allow attackers to bypass MFA protections if session reuse is possible on target systems.
  • Conduct forensic analysis of endpoints to determine whether the credential stealer payload was executed and what sensitive data was accessed.

    • ## References


  • [Fortinet FortiClient EMS Security Advisory](https://www.fortinet.com/psirt)
  • [Arctic Wolf Threat Intelligence Report on CVE-2026-35616](https://www.arcticwolf.com/)
  • [CVSS Details and Scoring Methodology](https://www.first.org/cvss/)

    • ---


    ## HackWire Analysis


    This vulnerability exposes a critical blind spot in how enterprises think about endpoint management: the trust placed in centralized management infrastructure is precisely what makes it such an attractive target. FortiClient EMS is designed to be the single source of truth for endpoint security and policy, which means compromising it grants attackers God-mode access to every managed device simultaneously. Unlike traditional network breaches that require lateral movement and enumeration, CVE-2026-35616 allows attackers to skip directly to mass payload delivery.


    What makes this particularly dangerous is the pre-authentication requirement. This isn't an issue that requires valid credentials or multi-step social engineering; an attacker on the internet can exploit this remotely and immediately. The fact that Fortinet patched it in version 7.4.7 suggests this flaw was in the wild for some time before disclosure, meaning active exploitation likely predates the public advisory. Organizations that haven't patched are not theoretically at risk—they are actively being targeted right now.


    The credential stealer payload itself deserves attention. Rather than immediately exfiltrating data through the stealer binary, the attackers designed a multi-stage attack where a PowerShell script handles network communication. This is evasion tradecraft: the stealer runs locally and writes credentials to disk, while the PowerShell layer handles exfiltration separately. If the stealer is detected and blocked, the architecture still allows defenders to contain the breach locally. If the PowerShell component is detected, the stealer artifact is already written to disk and may survive remediation attempts.


    The theft of session cookies and browser autofill data (credit cards, addresses) signals a two-pronged attack strategy: immediate credential access for cloud and internal systems, combined with identity fraud capabilities. And the detail that session cookie theft may bypass MFA is worth repeating—organizations with strong MFA on authentication endpoints may still lose effective control of accounts if session-based access is stolen. This is a pattern we've seen escalate across threat actor campaigns in the past year, and it suggests defenders need to monitor not just login events but session activity and anomalies.


    For defenders, this reinforces a fundamental principle: endpoint management infrastructure must be treated as a crown jewel in your security architecture. If you operate FortiClient EMS, treat this patch with the same urgency as a network firewall zero-day. If you operate *any* centralized endpoint management system, assume it's also a potential attack vector and plan your architecture accordingly.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)