FortiClient EMS login bypass CVE-2026-35616 exploited to spread credential-stealing malware
Attackers used FortiClient EMS 7.4.5–7.4.6 to take over management functions without logging in and spread password-stealing malware. Organisations should upgrade EMS to 7.4.7 or later and investigate managed computers for compromise.
If your workplace or family office uses FortiClient, ask its IT provider to confirm that the EMS server runs 7.4.7 or later, or has the appropriate Fortinet hotfix. Ask them to check managed computers for credential theft and unauthorised configuration changes. Fortinet says FortiClient Cloud and FortiSASE customers need no action for this flaw.
What’s happening
CVE-2026-35616 lets an attacker reach FortiClient EMS management functions without logging in and run unauthorised code or commands. EMS centrally manages an organisation’s FortiClient software, putting managed computers at risk when the server is compromised. Fortinet identifies versions 7.4.5 and 7.4.6 as affected; 7.2 and 8.0 are unaffected. Exploitation had been observed before the flaw was reported to Fortinet on 31 March. Fortinet disclosed it on 4 April with emergency hotfixes, and CISA listed it on 6 April. Regular release 7.4.7 also fixes it. Although the advisory’s summary still calls that release upcoming, Fortinet’s release notes confirm the fix and its April re-release. Fortinet says it has also remediated FortiClient Cloud and FortiSASE, requiring no customer action there. In May, Arctic Wolf observed attackers using compromised EMS deployments to spread EKZ malware that stole browser passwords, cookies and autofill data. Fixes are available, but affected organisations should also investigate their managed computers.
- What
- Flaw
- Affects
- Fortinet FortiClient EMS
- Affected
- FortiClient EMS 7.4.5
FortiClient EMS 7.4.6 - Fixed in
- FortiClient EMS 7.4.7 or later
FortiClient EMS 7.4.5 GA hotfix 1 (7.4.5.2111.1277073)
FortiClient EMS 7.4.6 GA hotfix 1 (7.4.6.2170.1277073)
FortiClient Cloud: remediated by Fortinet
FortiSASE: remediated by Fortinet - Since
- 6 Apr 2026
- Closed
- 27 May 2026
Timeline
- Wider attacks
Arctic Wolf reported May attacks that used the flaw to distribute EKZ credential-stealing malware through managed computers. The malware collected browser passwords, session cookies and autofill information, including card details.
- New fixFixed
Fortinet re-released the fixed 7.4.7 version as build 2194.M to address an upgrade problem that could cause data loss. Customers who had successfully installed build 2193.M did not need another upgrade.
- CISA added
CISA added CVE-2026-35616 to its Known Exploited Vulnerabilities catalogue.
- Made publicPartly fixed
Fortinet disclosed CVE-2026-35616, confirmed exploitation and provided hotfixes for FortiClient EMS 7.4.5 and 7.4.6. The regular 7.4.7 release was still forthcoming.
- Update
Defused reported the flaw to Fortinet after observing attacks, according to Arctic Wolf’s later account.
Sources
- FG-IR-26-099: API authentication and authorization bypassFortinet · 4 Apr 2026
- FortiClient EMS 7.4.7 resolved issuesFortinet
- FortiClient EMS 7.4.7 special noticesFortinet
- FortiClient EMS 7.4.5 GA hotfix 1Fortinet
- FortiClient EMS 7.4.6 GA hotfix 1Fortinet
- New FortiClient EMS flaw exploited in attacks, emergency patch releasedBleepingComputer · 5 Apr 2026
- CVE-2026-35616: Fortinet FortiClientEMS improper access control vulnerability exploited in the wildTenable · 6 Apr 2026
- FortiClient EMS Exploited via CVE-2026-35616 to Deliver EKZ Infostealer Disguised as a Fortinet PatchArctic Wolf · 27 May 2026
- Hackers exploit FortiClient EMS flaw to push infostealer malwareBleepingComputer · 28 May 2026