Tag: forticlient ems

2 Attack Reports | 0 Vulnerabilities

Attack reports

FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet Patch

In May 2026, threat actors exploited CVE-2026-35616, an improper access control vulnerability in FortiClient Endpoint Management Server (EMS), to bypass API authentication and execute privileged requests without credentials. Attackers leveraged trusted endpoint management infrastructure to push mal…

forticlient ems

ekz infostealer

endpoint exploitation

vpn configuration abuse

Published: May 28, 2026

Linked vulnerabilities : CVE-2026-35616 (CVSS 9.8), CVE-2026-0300 (CVSS 9.3)

Downloadable IOCs: 5

Attackers exploiting a FortiClient EMS vulnerability in the wild

Kaspersky's GERT team identified an attack exploiting a patched vulnerability (CVE-2023-48788) in FortiClient EMS versions 7.0.1 to 7.0.10 and 7.2.0 to 7.2.2. The attackers used SQL injection to infiltrate a company's network through an exposed Windows server. They deployed remote access tools like…

forticlient ems

credential theft

lateral movement

Published: December 19, 2024

Downloadable IOCs: 0

Click here to see more Attack Reports