#3
BleepingComputer
general
May 28, 2026 at 17:25 UTC
Hackers exploit FortiClient EMS flaw to push infostealer malware
By Bill Toulas
AI Summary
Threat actors are actively exploiting CVE-2026-35616, an authentication bypass in Fortinet's FortiClient Enterprise Management Server (EMS), to deliver a previously undocumented credential stealer dubbed EKZ. Arctic Wolf confirmed the campaign abused trusted endpoint management infrastructure to push malware across managed endpoints. Fortinet issued hotfixes in April 2026 after identifying in-the-wild exploitation as a zero-day.
Relevance score: 80.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →