Critical FortiClientEMS CVE-2023-48788 exploited to deploy EKZ malware

Key Takeaways

• A critical improper access control vulnerability, CVE-2026-35616, in FortiClient Endpoint Management Server (EMS) is actively being exploited.
• The flaw allows unauthenticated attackers to gain administrative control over EMS, enabling the deployment of a new credential stealer, dubbed EKZ Infostealer, across all managed endpoints.
• The EKZ Infostealer targets both Chromium and Gecko-based browsers, harvesting sensitive data including saved passwords, session cookies, and autofill information.
• Fortinet has released patches for CVE-2026-35616, and immediate upgrade is strongly recommended.

FortiClient Endpoint Management Server (EMS) is facing a significant threat from a new exploitation campaign. Malicious actors are leveraging a previously undisclosed vulnerability to gain administrative control over EMS infrastructure, subsequently deploying a novel credential-stealing malware to endpoints managed by the system.

Researchers at Arctic Wolf first identified this wave of attacks in May 2026. The campaign exploits CVE-2026-35616, an improper access control vulnerability within FortiClient EMS. This critical flaw enables unauthenticated attackers to bypass API authentication mechanisms, sending privileged requests to vulnerable deployments and effectively seizing administrative control without requiring valid login credentials.

Attackers Weaponize FortiClient EMS Infrastructure

Once threat actors successfully compromise the EMS configuration, they manipulate the Remote Access Profile and endpoint policies. This modification allows them to inject malicious scripts designed to execute on all managed devices. The attackers exploited a legitimate feature of FortiClient EMS: its support for script execution via on_connect directives when a VPN tunnel is established.

When an affected endpoint connects via an IPsec VPN tunnel, the fortitray.exe process launches .cmd script files. These scripts, named with GUIDs, are discreetly stored within FortiClient’s standard VPN logging path, specifically: C:Program FilesFortinetFortiClientlogsTracescripts{GUID}.cmd.

These scripts then decode and execute a base64-encoded PowerShell payload. This payload downloads the malicious executable, runs it silently, pauses for 90 seconds, and then exfiltrates any collected data via HTTP POST to an attacker-controlled Virtual Private Server (VPS) located at 83[.]138.53[.]110.

The observed execution chain leading to the malware deployment is as follows:

• fortitray.exe or ipsec.exe → cmd.exe → powershell.exe → FortiEndpoint_Patch.exe

Initial exploitation events were also linked to login attempts originating from multiple Tor exit node IP addresses, including 185[.]220.101.15 and 192[.]42.116.14, occurring mere hours after the API authentication bypass was achieved.

EKZ Infostealer: A New Credential Harvester

The payload downloaded by the malicious scripts, disguised as FortiEndpoint_Patch.exe, is a MinGW-compiled Windows binary. Arctic Wolf researchers have named this new threat “EKZ Infostealer,” a designation derived from internal symbol strings found within its decrypted code. This infostealer was first observed in May 2026 and had not been documented prior to this campaign.

The EKZ Infostealer is designed to target a wide range of web browsers. It focuses on both Chromium-family browsers (such as Chrome and Edge) and Gecko-family browsers (including Firefox, LibreWolf, and Thunderbird). For Chromium browsers, EKZ locates installations through the system registry. It then copies itself into the browser’s Application directory to circumvent Elevation Service path validation, subsequently calling IElevator::DecryptData to obtain the v20 AES-256 master key necessary for decrypting credential databases.

When targeting Firefox, the infostealer dynamically loads nss3.dll to extract sensitive data from key4.db, logins.json, and cookies.sqlite. The harvested data encompasses a broad spectrum of sensitive information, including saved passwords, active session cookies, and autofill entries such as credit card details. This stolen data is written to a log.txt file located in the ProgramData directory and then exfiltrated on a scheduled basis.

Arctic Wolf emphasized that the theft of session cookies is particularly dangerous, as it can enable full account takeover even in environments protected by multi-factor authentication (MFA), as detailed in their official report.

Indicators of Compromise

What You Should Do

Organizations utilizing FortiClient EMS should treat this incident with the highest priority, as a compromise of a single EMS instance can lead to widespread exposure across all managed endpoints.

• Patch Immediately: Upgrade FortiClient EMS to a patched version that addresses CVE-2026-35616 without delay.
• Restrict Management Port Access: Limit network access to EMS port 8013 (or your configured management port) to only trusted IP ranges and administrative workstations.
• Audit VPN Script Configurations: Thoroughly review all on_connect and script directives within your Remote Access Profiles for any unauthorized or suspicious entries.
• Hunt for Indicators of Compromise (IOCs): Proactively search endpoint logs for GUID-named .cmd files located in the FortiClient logsTracescripts path and investigate any anomalous process chains involving fortitray.exe.
• Rotate Browser Credentials: Assume that all credentials and session cookies on endpoints managed by a potentially compromised EMS instance are compromised and initiate a mandatory rotation of all affected user credentials and sessions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.