CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Fortinet FortiClient EMS

product · product:fortinet-forticlient-ems

Coverage
1
first 2026-05-29 → last 2026-10-11
Latest activity
2026-05-29
Attackers abused a FortiClient EMS auth bypass to add VPN connect scripts that installed a credential stealer…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
4 hosts

Defender insights

What each entry about Fortinet FortiClient EMS tells a defender to do, newest first.

2026-05-29NOTABLEexploitedAttackers abused a FortiClient EMS auth bypass to add VPN connect scripts that installed a credential stealer posing as a Fortinet patch

Exposure · detection

Story timeline

  1. 2026-05-29FortiClient EMS CVE-2026-35616: exploited API authentication bypass used to push VPN on-connect scripts that drop EKZ Infostealer on managed endpoints
    trending-vulnerabilitiesAttackers abused a FortiClient EMS auth bypass to add VPN connect scripts that installed a credential stealer posing as a Fortinet patch

Hunting pivots

CVEs (exploited first)
CVE-2026-35616
Releases covered
Fortinet FortiClient EMS
Tags
actively-exploitedcisa-kevpatch-availablepre-authvulnerabilities
ATT&CK techniques (7 across 5 tactics)

7 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: PowerShell · Command and Scripting Interpreter: Windows Command Shell · Software Deployment Tools
  • StealthMasquerading: Match Legitimate Resource Name or Location
  • Credential AccessSteal Web Session Cookie · Credentials from Password Stores: Credentials from Web Browsers
  • Lateral MovementSoftware Deployment Tools

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

Execution TA0002

T1059.001Command and Scripting Interpreter: PowerShell×1

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

T1059.003Command and Scripting Interpreter: Windows Command Shell×1

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

T1072Software Deployment Tools×1

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

Credential Access TA0006

T1539Steal Web Session Cookie×1

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

T1555.003Credentials from Password Stores: Credentials from Web Browsers×1

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

Lateral Movement TA0008

T1072Software Deployment Tools×1

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

Evidence: 2026-05-29/forticlient-ems-cve-2026-35616-ekz-infostealer-kill-chain · ATT&CK page ↗

Entries about Fortinet FortiClient EMS (1)

2026-05-29 · view entry permalink →

NOTABLECVE-2026-35616exploitedupdatedNATOA1

FortiClient EMS CVE-2026-35616: exploited API authentication bypass used to push VPN on-connect scripts that drop EKZ Infostealer on managed endpoints

CVE-2026-35616 is an API authentication bypass in FortiClient EMS 7.4.5 and 7.4.6 that Fortinet has observed exploited in the wild; a hotfix exists for both versions and 7.4.7 includes the fix (Fortinet PSIRT, FG-IR-26-099). CISA added it to its Known Exploited Vulnerabilities catalog on 2026-04-06 (CISA KEV catalog, 2026-04-06). Bishop Fox traced the bypass to EMS's Django middleware trusting client-supplied X-SSL-CLIENT-VERIFY and certificate headers as if Apache had set them, combined with chain validation that matches only subject and issuer names without checking signatures, so a forged certificate chain passes (Bishop Fox, 2026-04-07).

Arctic Wolf documented a campaign that used the flaw to reach managed endpoints (Arctic Wolf, 2026-05-27). After authenticating as a Fabric device, the actor deferred upgrade reminders and edited the Remote Access Profile and endpoint policy to add scripts that run when FortiClient establishes a VPN tunnel; within seconds of an IPsec tunnel coming up, fortitray.exe launched GUID-named .cmd files through cmd.exe, which ran base64-encoded PowerShell that downloaded and ran a payload, slept 90 seconds and sent the script output out (Arctic Wolf, 2026-05-27). The payload, disguised as FortiEndpoint_Patch.exe, is EKZ Infostealer, which exports credentials, cookies and autofill data from Chromium and Firefox browsers to a log file; for Chromium it copies itself into the browser's Application directory to get past app-bound encryption, and stolen cookies can let attackers reuse sessions without triggering MFA (Arctic Wolf, 2026-05-27).

Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6

Fortinet PSIRT 2026-04-04
Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_datetagsregionssectorstechniquesaffected_productscvessourcesevidenceclassificationdeep_divedeep_dive_categorybody

Bishop Fox attributes the bypass to EMS's Django middleware accepting client-supplied certificate headers and to chain validation that checks names without signatures (Bishop Fox, 2026-04-07); the earlier comparison with a SharePoint flaw was wrong. In Arctic Wolf's campaign the endpoints ran attacker scripts through VPN on-connect settings that fortitray.exe or ipsec.exe launched, and EKZ copies itself into the browser's Application directory (Arctic Wolf, 2026-05-27); the earlier detection guidance on update tasks and profile writes did not match the observed behaviour.

vulnerability29 May 05:00Zmulti-sourceOpen finding →
Sources: Fortinet PSIRT · Bishop Fox · Arctic Wolf · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • arcticwolf.com1 (25%)
  • bishopfox.com1 (25%)
  • cisa.gov1 (25%)
  • fortiguard.fortinet.com1 (25%)
All cited sources (4)