The perimeter is undrawn: FortiClient EMS exposes the management console as an intrusion vector

A new attack on endpoints management infrastructure underlines a basic principle of safety: when the tool that should be protected is compromised, the perimeter is blurred. In May 2026, a campaign was observed that took advantage of critical vulnerability in FortiClient EMS, identified as CVE-2026-35616, to distribute a credentials thief who impersonated a legitimate customer update. What makes it particularly dangerous is not only the gravity of the failure, but the vector chosen: the very management path that managers use to deploy policies and updates.

The operation, according to the analysis published by researchers, allowed to avoid the authentication of the API and obtain sufficient privileges to modify EMS configurations, insert malicious scripts and run remote commands on all managed endpoints, without the need to compromise each device separately. Among the signs of attack identified are the presence of the camouflaged executable called FortiEndpoint _ Patch.exe, use of fortitra.exe to release .cmd scripts and the invocation of PowerShell with coded payloads in Base64 that download and exfilter information sensitive to an infrastructure controlled by the attacker.

The practical risk is high: the looters to Chromium and Gecko-based browsers can capture session cookies and stored credentials, potentially allowing you to reuse sessions to access cloud, internal and third-party services, even in MFA-based environments if session reuse allows. In addition, by taking advantage of legitimate controls of the management platform, attackers can hide the activity within apparently valid administrative operations, making detection difficult by traditional processes.

The operational implications are clear: first, immediately update FortiClient EMS to the corrected version (7.4.7 or higher), since the manufacturer has published patches that close the API authentication bypass. Fortinet maintains security information and notices on its official portal, which is the primary source for patches and mitigation: https: / / www.fortinet.com / support / product-security. In parallel, it is essential to activate response processes that include the rotation of credentials, session invalidation and revision of tokens and cookies that may have been captured.

From the point of view of detection and containment, it is appropriate to look for specific indicators: modifications in remote access profiles and endpoint policies in EMS, presence of FortiEndpoint _ Patch.exe in directories such as ProgramData, running of cmd.exe invoked by fortitra.exe, and PowerShell commands with parameters - EncodedCommand or calls to Invoke-Expression to download binaries. Monitoring HTTP POST outputs to suspicious directions and blocking communications to known malicious infrastructures is another immediate action that can mitigate ongoing exfiltration.

It is not enough to block traffic: management must be tightened. Isolate the network and administrative access of EMS, force MFA for accounts that manage the console, restrict API access by white list of IPS and enable detailed change registration are mitigation measures that reduce the impact of a similar violation in the future. It is also recommended to apply minimum privilege principles in EMS accounts and to segment the management console so that a committed access does not give full control over all endpoints.

The campaign also serves as a reminder to review the performance position of PowerShell and scripts in endpoints: implement restricted execution policies, enable implementation block of coded commands where possible and take advantage of native anomalous behavior detection capabilities in PowerShell. Microsoft offers guides and best practices on PowerShell security that can help harden these surfaces: https: / / learn.microsoft.com / powershell / scripting / overview.

For incident response teams and CSIRT, the recommended actions include the forensic collection of the EMS to recover configuration changes, management log review, search for managed endpoints and coordination with the supplier to validate the integrity of the environment. Notify the parties concerned, assess the extent of access to sensitive accounts and, where appropriate, contact the authorities and external specialists in response to incidents are prudent steps to manage exposure.

Finally, this incident reaffirms a strategic lesson: trusting the chain of management tools without compensatory controls is a systemic risk. Organizations should treat management consoles as critical assets and protect them with strict controls, continuous audit and specific response plans. Technical prevention (patching and segmentation), attack device-oriented detection and well-tested response procedures are the necessary combination to mitigate not only this particular threat, but the kind of attacks that exploit administrative confidence.