Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

FortiClient EMS CVE-2026-35616 exploitation wave

Exploitation Wave
First reported
Last updated
Happening score
H score 56
2 unique sources, 2 articles

Summary

Hide ▲

CVE-2026-35616 exploitation in FortiClient Enterprise Management Server (EMS) is being used to deliver the undocumented credential stealer EKZ. Attackers are abusing unauthenticated API access and FortiClient-managed VPN scripting workflows to disguise the payload as a Fortinet endpoint update, launch malicious scripts through fortitray.exe and cmd.exe, and exfiltrate stolen data to an attacker-controlled VPS over HTTP. Fortinet released emergency hotfixes for 7.4.5 and 7.4.6, CISA ordered federal agencies to secure affected instances, and The Shadowserver Foundation reported 2,000 internet-exposed EMS instances.

Cases

FortiClient EMS CVE-2026-35616 exploitation and stealer delivery (2)

Related Happenings

FortigateSniffer FortiOS packet-sniffer credential-harvesting tool

Malware Activity
H score72 First: 22.06.2026 23:01 Last: 22.06.2026 23:01 Sources 1

About this happening: **FortigateSniffer** is a **Golang-based credential-harvesting tool** used in the **FortiBleed** operation against **FortiGate firewalls**. It abuses **FortiOS** packet-sniffing f...

Open Happening

Initial access broker (IAB) campaign expands across multiple victims

Campaign
H score89 First: 22.06.2026 23:01 Last: 22.06.2026 23:01 Sources 1

About this happening: The **FortiBleed** campaign is a live **credential-harvesting** activity targeting **Fortinet FortiGate** devices worldwide. It has been active since at least **February 2026** an...

Latest development: 23.06.2026 13:30

On June 15, attackers behind FortiBleed successfully cracked Kerberos hashes and immediately exfiltrated DFS backup data from a NATO-aligned defense contractor, extending the campaign from credential harvesting into direct data theft.

Open Happening

CISA warning on FortiBleed for FortiGate customers

Public Sector Action
H score89 First: 19.06.2026 17:00 Last: 19.06.2026 17:00 Sources 1

About this happening: **CISA** warned **Fortinet** customers with **FortiGate appliances** to secure exposed systems against ongoing malicious activity tied to **FortiBleed**. The activity had reached...

Open Happening

FortiBleed Fortinet credential-theft campaign

Campaign
H score89 First: 19.06.2026 13:48 Last: 19.06.2026 13:48 Sources 1

About this happening: The **FortiBleed** Happening is a global **Fortinet credential-theft** campaign affecting **FortiGate firewall** and **SSL VPN** customers. The **UK’s NCSC** issued guidance after...

Latest development: 22.06.2026 11:30

The UK’s National Cyber Security Centre issued guidance for Fortinet customers impacted by FortiBleed after the campaign exposed around 75,000 credentials from FortiGate firewall and SSL VPN customers. The NCSC urged affected organizations to use Hudson Rock’s or SOCRadar’s FortiBleed checker tools and then review indicators of compromise such as unauthorized account creation and unexpected activity in log files.

Open Happening

Russian-speaking FortiGate and Microsoft SQL Server bruteforce campaign

Campaign
H score82 First: 17.06.2026 18:12 Last: 17.06.2026 18:12 Sources 1

About this happening: A Russian-speaking multi-operator threat group ran a **FortiGate** and **Microsoft SQL Server** bruteforce campaign that generated **billions of credential attempts**, raising the...

Open Happening

Timeline

  1. 28.05.2026 18:26 3 articles · 1mo ago

    Initial report: FortiClient EMS CVE-2026-35616 exploitation wave

    Initial Disclosure

    By **May 2026**, attackers were using a patched **FortiClient EMS** flaw to push malicious scripts through the product's management path. The early phase centered on abusing EMS controls to reach every managed endpoint from a privileged context.

    Show sources
    Open in new tab