FortiClient EMS Vulnerability Exploited: Lateral Risks Exposed by the Enterprise Endpoint Management Platform

FortiClient EMS Vulnerability Exploited Again: Why Endpoint Management Platforms Become High-Value Attack Surfaces

According to SecurityWeek, Fortinet’s high-severity vulnerability in FortiClient Endpoint Management Server (EMS), which was hotfixed in April, has recently reappeared in real-world attacks and has been used to deliver the information-stealing trojan EKZ Infostealer. The vulnerability is identified as CVE-2026-35616, with an NVD-recorded CVSS score of 9.1. It can remotely trigger unauthorized remote code execution (RCE) through a carefully crafted request. Fortinet had previously confirmed that the flaw was being exploited in the wild as a zero-day and has patched it. CISA has also added it to the Known Exploited Vulnerabilities (KEV) list, further indicating that it has verifiable attack value in real-world environments.

This kind of incident is not just “another high-severity vulnerability.” FortiClient EMS plays the role of centrally managing FortiClient devices, policies, and configurations in enterprise environments, so it is essentially the control hub for endpoint and remote access policies. Once attackers compromise such a system, they do not need to infect endpoints one by one; instead, they may be able to directly issue commands to managed devices through the management channel. Arctic Wolf’s analysis shows that in recent attacks, the malicious payload appears to have been executed via the FortiClient management path and VPN script workflow, with command content invoking PowerShell and exhibiting characteristics that “look like legitimate administrative operations.” This means detection is significantly more difficult than with traditional externally delivered malware attacks.

Attack Methods and Exploitation Chain: From a Single Compromise to Collective Control

Based on the publicly available information, the attack chain mainly includes the following steps:1. Exposure Surface Identification: The attacker searches for FortiClient EMS instances that have not yet been patched. 2. Remote Vulnerability Exploitation: By exploiting CVE-2026-35616 to trigger RCE, the management platform can be accessed without authentication. 3. Abuse of Management Functions: Using EMS management mechanisms, scripts or commands are pushed to managed endpoints. 4. PowerShell Execution: Commands are run on the endpoint side through a script workflow, reducing the apparent abnormality of malicious behavior. 5. Delivery of an Infostealer: EKZ Infostealer is ultimately deployed to steal credentials, cookies, and autofill data from Chrome, Microsoft Edge, Firefox, and other Chromium/Gecko browsers. 6. Data Exfiltration: The collected data is exfiltrated over HTTP.

The danger of this pattern lies in turning a traditional “single vulnerability” into a “platform-level chain compromise.” If EMS, as a centralized management plane, is breached, attackers no longer need to break through endpoint defenses one by one; instead, they can directly affect a large number of assets by leveraging existing trust relationships. For a SOC, this kind of activity may appear in logs closer to normal management traffic and remote maintenance operations, making it easier to misclassify as routine administration.

Affected Assets: Not Just Endpoints, but Also Identity and the Management Plane

The affected assets involved in this incident include at least three layers:

• Endpoint assets: Managed Windows/macOS devices may be uniformly pushed scripts and malicious commands.
• Identity and Access systems: Credentials, session cookies, and autofill data saved in browsers may be further used for account takeover.
• Management Plane: FortiClient EMS itself, as the control hub, once compromised, expands the attack surface from a single endpoint to the entire managed group.

For enterprises that have already deployed unified endpoint management, VPN policy distribution, and remote-work access capabilities, this means that the compromise of one control point may affect multiple business units. This is especially true for organizations with hybrid work environments, outsourced operations, and cross-region endpoint management: the “centralized governance advantage” of such platforms can be reversed into a “centralized destruction advantage” in the hands of attackers.

Business Impact: Operational, Financial, Compliance, and Reputational Risks All Rise Simultaneously

1. Operational RiskIf EMS is exploited, organizations may face issues such as widespread tampering with endpoint policies, abuse of VPN scripts, and indirect manipulation of endpoint security configurations. This can affect remote work, asset management, patch distribution, and the consistency of security policies. For organizations that rely on unified endpoint control, recovery time may depend not only on vulnerability remediation, but also on whether the management plane needs to be rebuilt and forensically investigated.

2. Financial Risk

The usual goal of infostealer trojans is not to destroy systems, but to obtain access for subsequent attacks. Stolen credentials can be used for email intrusion, SaaS account takeover, VPN logins, and lateral movement within business systems, ultimately leading to ransomware, fraud, or secondary supply chain compromise. The resulting costs of downtime, response, legal action, and customer notification often far exceed the cost of a single patch deployment.

3. Compliance Risk

If the stolen data includes employee or customer identity information, session tokens, or credentials for regulated business systems, the organization may need to face pressure from data breach notifications, audit trails, and cross-border compliance assessments. For organizations subject to financial, healthcare, government contracting, and critical infrastructure regulations, this kind of credential leakage may also trigger stricter internal reporting and third-party notification requirements.

4. Brand Risk

When attackers use disguised payloads that “look like official Fortinet patches,” the incident will trigger dual scrutiny from users and partners regarding the vendor’s update channels, the organization’s patch governance capabilities, and the maturity of its security operations. Even if no large-scale data leakage ultimately occurs, the compromise of the vendor management platform itself will still weaken external trust.

Risk Level Assessment: Why This Should Be Treated as a High-Priority Incident

From the perspective of enterprise security management, this incident should be regarded as a high-priority, high-impact exploitation event for three reasons:

• The vulnerability is remotely exploitable and requires no authentication, making the attack barrier low;
• The target is a management platform, not a single endpoint, creating a significant amplifying effect;
• It has been confirmed as exploited in the wild and added to CISA KEV, indicating that the threat is real rather than merely theoretical.

Unlike ordinary endpoint vulnerabilities, the priority of this kind of management platform vulnerability should be close to that of identity systems and domain controller components: once breached, what is affected is not just the infected devices, but the trust boundary of the entire managed ecosystem.

Industry Trend: Endpoint Management Systems Are Becoming Attackers’ “High-Leverage Entry Point”

This incident reflects a continuing and intensifying industry trend: attackers are increasingly inclined to target the management plane rather than only business endpoints. The reason is straightforward — management systems have higher privileges, broader coverage, and more stable execution paths. Whether it is an EDR management console, a VPN orchestration system, a cloud management backend, or an endpoint policy distribution platform, once a vulnerability appears, it shifts from “single-point exposure” to “large-scale control.”From a trend perspective, this also forms a mirror image with the zero trust and unified endpoint management initiatives enterprises have been advancing in recent years: enterprises hope to improve efficiency through centralized management, while attackers use the same centralized capabilities to increase the efficiency of destruction. In the future, CISOs need to bring such platforms into the same level of protection as identity infrastructure and cloud consoles, rather than treating them merely as operational tools.

Defensive and Response Recommendations: Immediate Actions for Enterprises

At the enterprise level

• Immediately check whether FortiClient EMS is exposed on the internet and confirm its patch status.
• Include EMS, VPN management consoles, EDR consoles, and similar systems in the highest-priority asset inventory.
• Implement stricter segmented access and the principle of least privilege for remote management systems.

At the identity security level

• Enforce MFA, especially for administrator and remote-access-related accounts.
• Review browser-saved credentials and session management policies to reduce long-term credential retention on endpoints.
• Monitor for anomalous logins, logins from different locations, and signs of session hijacking.

At the technical level

• Focus SIEM monitoring on PowerShell, script execution, and abnormal administrative operations.
• Use EDR/XDR to correlate management plane logs with endpoint behavior to identify "malicious execution through legitimate channels."
• Integrate the CISA KEV list and vendors’ high-severity advisories into the vulnerability management process to avoid delayed patching.

At the management level

• Reassess the risk classification of third-party and vendor management platforms.
• Develop dedicated IR (incident response) plans for management-plane compromise scenarios.
• Introduce dual approval, change auditing, and rollback mechanisms for high-privilege configuration changes.

SecurityPost Insight

The FortiClient EMS vulnerability being reused in real-world attacks shows that what enterprises truly need to protect is not just the endpoint itself, but the "management trust chain" that controls the endpoint. When attackers can issue commands through legitimate management paths, traditional defense thinking centered on the perimeter, malicious files, and outbound traffic becomes insufficient. For CISOs, the key takeaways from such incidents are threefold: first, endpoint management platforms should be regarded as part of critical infrastructure; second, patch prioritization must tilt toward management systems that are remotely exploitable, unauthenticated, and already exploited in the wild; third, detection capabilities need to evolve from single-host malware removal to joint analysis of administrative actions, script execution, and identity abuse. The trend worth watching in the future is that attackers will continue shifting targets from "devices" to "the systems that control devices," further moving enterprise security boundaries toward identity, configuration, and operational processes. Whoever can identify and isolate these high-leverage entry points earlier will be more likely to avoid systemic compromise in the next wave of attacks.