FortiClient EMS Code Execution Vulnerability Exploited to Deploy EKZ Malware

A newly observed exploitation campaign targeting FortiClient Endpoint Management Server (EMS) has weaponized trusted administrative infrastructure to silently deploy a previously unreported credential stealer across managed enterprise endpoints. In May 2026, Arctic Wolf researchers identified a cluster of malicious activity exploiting CVE-2026-35616, an improper access control vulnerability in FortiClient EMS. The flaw allows unauthenticated threat […] The post FortiClient EMS Code Execution Vulnerability Exploited to Deploy EKZ Malware appeared first on Cyber Security News.