Dossier
FortiClient Enterprise Management Server
Coverage of FortiClient Enterprise Management Server in the Nexus archive.
- Hackers exploit FortiClient EMS flaw to push infostealer malware
Hackers are exploiting an authentication bypass vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS) to deliver an undocumented credential stealer called EKZ.
- Attackers exploited this critical FortiClient EMS bug as a 0-day
A critical vulnerability in FortiClient Enterprise Management Server (EMS) was exploited as a 0-day attack, prompting Fortinet to release an emergency patch. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) list after confirming real-world exploitation since March 31.