The Patch Was Malware. FortiClient EMS Delivered It Like an Update
Attackers did not have to compromise every workstation separately. After exploiting CVE-2026-35616 in FortiClient Endpoint Management Server, they used the product’s own trusted administration path to deliver a credential stealer across managed endpoints. The payload was even named FortiEndpoint_Patch.exe, making malicious execution look like routine security maintenance.
Arctic Wolf Labs documented the campaign on 27 May 2026 and named the previously unreported malware EKZ Infostealer. The important part is not only the malware. It is the force multiplier. One exposed management server became a software-distribution channel with reach across an organisation’s endpoint fleet.
The vulnerability converted unauthenticated requests into administrative actions
CVE-2026-35616 is an improper access-control flaw in FortiClient EMS 7.4.5 and 7.4.6. Specially crafted requests to affected API endpoints can be processed without valid credentials as though they were legitimate privileged operations. Fortinet rated the issue critical and confirmed exploitation before the May campaign details became public.
- Affected product: FortiClient EMS 7.4.5 and 7.4.6
- Entry condition: network access to the vulnerable EMS service
- Authentication: none required
- Observed impact: privileged configuration changes followed by malware delivery to managed endpoints
- Remediation: apply Fortinet’s hotfix or move to a fixed release, and restrict management access to trusted networks
- CISA status: Known Exploited Vulnerabilities catalogue, added 6 April 2026
The trusted VPN workflow became the execution mechanism
The actor changed FortiClient EMS Remote Access Profile and endpoint-policy settings to insert an unapproved script. FortiClient can legitimately run scripts when an endpoint establishes a VPN tunnel. In the observed campaign, that feature caused the trusted FortiClient processes fortitray.exe or ipsec.exe to launch a command file, which then invoked a base64-encoded PowerShell downloader.
PowerShell retrieved the fake patch from an attacker-controlled server, executed it without a visible window, waited for the stealer to collect data, and sent the resulting file out over HTTP. The script then removed the payload and local collection file. The endpoint therefore received the malicious instruction through the same channel administrators use to manage it.
EKZ targets the credentials that extend an intrusion
EKZ Infostealer collects browser data from Chromium-based browsers and Firefox-family browsers. Arctic Wolf says its capabilities include credentials, cookies and autofill information, as well as techniques aimed at Chrome’s encrypted password storage. Stolen session cookies can be particularly consequential because they may permit access to cloud and internal services without presenting the attacker with a fresh multi-factor authentication prompt.
The malware’s filename and delivery route were tailored to the compromised environment. That reduces the value of controls that judge a process only by its parent, path or apparent administrative purpose. A trusted product launched the script. A plausible vendor-labelled file arrived through management policy. The malicious part was the instruction, not the transport.
Patching the server is only the first response step
Fortinet issued hotfixes for the affected 7.4.5 and 7.4.6 builds and directed customers toward fixed releases. Organisations should also restrict access to the EMS management service, including port 8013, to explicit trusted ranges. Internet exposure of a system that can configure and execute actions across endpoints creates unnecessary blast radius even after this specific flaw is closed.
Systems exposed before remediation need incident review. Installing the update prevents the known entry path from being used again, but it does not undo malicious policy changes, remove payloads already delivered to endpoints or invalidate stolen browser sessions.
What defenders should hunt for
- Review EMS logs for
Certificate not found in request header.Arctic Wolf observed this during both laboratory exploitation and the real campaign. - Look for the certificate error followed within seconds by an unexpected successful update involving
fortinet-ca2. - Audit Remote Access Profiles, endpoint policies, new accounts and deferred upgrade reminders for unauthorised changes.
- Investigate FortiClient processes spawning
cmd.exe, followed by PowerShell and a download ofFortiEndpoint_Patch.exe. - Search for unexpected raw-IP HTTP downloads and POST requests, especially the indicators published in the Arctic Wolf report.
- Assume browser credentials and session cookies may have been exposed on affected endpoints. Reset or revoke them according to the services and identities at risk.
The campaign shows why endpoint-management infrastructure belongs in the same high-trust category as identity providers, software repositories and remote-management tools. Once the server was compromised, the attacker did not need to evade the deployment system. The deployment system became the attacker.
Sources
- Arctic Wolf Labs campaign analysis, published 27 May 2026. The page provides a date but no publication time.
- Fortinet PSIRT advisory, originally released 4 April 2026. The page provides a date but no publication time.
- CISA Known Exploited Vulnerabilities catalogue entry, added 6 April 2026. The catalogue provides a date but no publication time.
- BleepingComputer reporting, published 28 May 2026 at 13:25 EDT.
Update, 1 September 2026: EMS also had an exploited pre-authentication SQL injection
The malware-delivery campaign described above used CVE-2026-35616. FortiClient EMS also had a separate critical entry path: CVE-2026-21643, an unauthenticated SQL injection in version 7.4.4 that can lead to unauthorised code or command execution through crafted HTTP requests.
CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 13 April, and public exploit code is available. The two CVEs should not be treated as the same bug or attributed to the same campaign without evidence. They do create the same operational risk: compromise of a server that can push trusted instructions across the endpoint fleet.
Update EMS according to Fortinet’s advisory, restrict its management surface to trusted networks and investigate pre-patch systems for unexpected database activity, policy changes, scripts, endpoint jobs and payload delivery.
Primary sources: Fortinet PSIRT advisory and the CISA KEV catalogue.
