Cybersecurity · VIDEO
CVE-2026-35616: Infostealer targets companies through FortiClient EMS vulnerability
A new infostealer, dubbed EKZ Infostealer, is infecting enterprise devices by exploiting a known vulnerability (CVE-2026-35616) in FortiClient Enterprise Man...
KEY TAKEAWAYS
- CVE-2026-35616 is an improper access vulnerability in FortiClient EMS, publicly disclosed by Fortinet in April 2026.
- The attack exploits unauthenticated APIs to perform illegitimate administrative actions, distributing EKZ Infostealer.
- The infostealer steals credentials, session cookies, and autofill data from browsers like Chrome, Edge, Firefox, and others.
- Arctic Wolf has identified indicators of compromise and advises changing passwords and revoking active sessions.
- Remediation requires analyzing EMS logs and possible additional actions for compromised autofill data.
