FortiClient EMS Zero-Day (CVE-2026-35616) Exploited to Deliver EKZ Infostealer via Fake Patches — Unauthenticated RCE Across Managed Fleets

CVE-2026-35616 is an improper access control flaw in the FortiClient Endpoint Management Server API, CVSSv3 9.1, that lets an unauthenticated attacker bypass API authentication and issue privileged administrative requests against the EMS service on port 8013. Fortinet's advisory FG-IR-26-099, published April 4, 2026, already reported exploitation in the wild, and Arctic Wolf Labs has since documented the full chain: crafted requests that leave an EMS log line reading "Certificate not found in request header", a fabricated Fortinet fabric device identity, then tampering of Remote Access Profiles so a malicious script fires through FortiClient's on_connect behavior the moment an endpoint raises its IPsec tunnel. On the endpoint, fortitray.exe launches a .cmd script with base64-encoded PowerShell that pulls FortiEndpoint_Patch.exe from 83.138.53.110, an infostealer Arctic Wolf named EKZ that reads Chromium and Firefox credential stores including passwords, cookies and autofill card data, stages results in a local SQLite database and exfiltrates them over HTTP POST.

The story is not the bug but the calendar. The vendor fix has existed since early April, exploitation was confirmed by Fortinet itself in the same advisory, and the late-May incidents are landing in fleets that neither patched 7.4.5/7.4.6 nor closed 8013. The economics favor the attacker: a single write to a Remote Access Profile makes every managed endpoint a delivery target the next time its user opens a VPN tunnel, the payload borrows a Fortinet-sounding patch name so a quick glance at the process list looks routine, and the recovered trojanized installers show the compromised server doubling as a fake software distribution channel. The stolen material converts a management-plane problem into account takeover and payment fraud, since cookies and saved cards are lifted alongside passwords. That self-compounding property, one unpatched server silently arming an entire endpoint fleet through policy replication, is what separates this from the other exploit reports of the day.

Scoping comes first because the affected set is narrow: only FortiClientEMS 7.4.5 and 7.4.6, with 7.2 and 8.0 unaffected and FortiClient Cloud plus FortiSASE already remediated server side. Apply the 7.4.5/7.4.6 hotfix documented in the EMS release notes or upgrade to 7.4.7, and restrict port 8013 to management hosts; an EMS API reachable from the internet is the whole attack surface. Hunt for the string "Certificate not found in request header" in EMS logs followed within seconds by an unknown device registration, audit Remote Access Profiles and endpoint policies for on_connect script entries you did not author, and on endpoints look for fortitray.exe spawning cmd.exe or base64-encoded PowerShell. Block and back-search traffic to 83.138.53.110, and treat any endpoint that established a tunnel after a policy change as credential-compromised: rotate passwords, invalidate browser sessions, and assume autofill card data is burned.

Two developments would change the assessment. A CISA KEV listing or a public exploit would shift exploitation from targeted compromise to opportunistic mass scanning of 8013, collapsing the remaining window for unpatched fleets. And if the operators move beyond EKZ credential theft, either by pushing a second-stage implant through the same EMS policy channel or by deploying ransomware on harvested credentials, this stops being an infostealer incident and becomes a fleet-wide intrusion on par with domain controller compromise.