Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer
What’s new: Threat actors are exploiting a critical vulnerability (CVE-2026-35616, CVSS score: 9.1) in FortiClient Endpoint Management Server (EMS) to deploy credential-stealing malware. The flaw allows pre-authentication API access bypass leading to privilege escalation. The malware is disguised as a legitimate Fortinet update and is executed via PowerShell, affecting managed endpoints without requiring separate intrusion paths.
Who’s affected
Organizations using FortiClient EMS versions prior to 7.4.7 are at risk, as the vulnerability has been actively exploited to deliver malware across managed endpoints.
What to do
- Update FortiClient EMS to version 7.4.7 or later to mitigate the vulnerability.
- Monitor managed endpoints for unauthorized changes and suspicious activity.
- Review and tighten endpoint management configurations to prevent unauthorized script execution.
