FortiClient Code Execution Flaw Exploited by EKZ Vulnerability Deploy

FortiClient Endpoint Management Server (EMS) faces a new exploitation campaign. This attack weaponizes trusted administrative infrastructure to silently deploy a previously unreported credential stealer across managed enterprise endpoints.

In May 2026, Arctic Wolf researchers identified a cluster of malicious activity exploiting CVE-2026-35616, an improper access control vulnerability in FortiClient EMS.

The flaw allows unauthenticated threat actors to bypass API authentication and send privileged requests to affected deployments, effectively granting administrative control without valid credentials.

Attackers Abused FortiClient’s Own Infrastructure

Once threat actors gained access to the EMS configuration, they modified the Remote Access Profile and endpoint policy to inject malicious scripts targeting all managed devices.

FortiClient EMS supports script execution upon VPN tunnel establishment using on_connect directives, a legitimate feature that the attackers weaponized entirely.

When affected endpoints are connected via an IPsec tunnel, fortitray.exe launched .cmd script files with GUID-based filenames stored within FortiClient’s standard VPN logging path:

C:Program FilesFortinetFortiClientlogsTracescripts{GUID}.cmd

These scripts decoded and executed a base64-encoded PowerShell payload that downloaded the malicious executable, ran it silently, waited 90 seconds, and exfiltrated output via HTTP POST to a threat-actor-controlled VPS at 83[.]138.53[.]110.

The observed process lineage was:

• fortitray.exe or ipsec.exe → cmd.exe → powershell.exe → FortiEndpoint_Patch.exe

Initial exploitation was also linked to login events from multiple Tor exit node IPs, including 185[.]220.101.15 and 192[.]42.116.14, within hours of the API authentication bypass.

EKZ Infostealer – Credential Harvesting Tool

The downloaded payload, disguised as FortiEndpoint_Patch.exeIt is a MinGW-compiled Windows binary Arctic Wolf, designated as EKZ Infostealer, named after internal symbol strings extracted from decrypted code. This tool was first observed in May 2026 and had not been previously documented.

EKZ targets both Chromium-family browsers (Chrome, Edge) and Gecko-family browsers (Firefox, LibreWolf, Thunderbird). For Chromium browsers, it locates installations via the registry, copies itself into the browser’s Application directory to pass Elevation Service path validation, and calls IElevator::DecryptData to obtain the v20 AES-256 master key before decrypting credential databases.

For Firefox, it dynamically loads nss3.dll and extracts data from key4.db, logins.json, and cookies.sqlite.

Harvested data, including saved passwords, session cookies, and autofill entries like credit card details, is written to a log.txt in ProgramData, then exfiltrated on a timed schedule.

The stolen session cookies are particularly dangerous, as they can enable account takeover even where MFA protections are in place, Arctic Wolf observed.

Indicators of Compromise

Mitigations

• Patch immediately — Upgrade FortiClient EMS to a fixed version addressing CVE-2026-35616
• Restrict management port access — Limit network access to EMS port 8013 to trusted IP ranges only
• Audit VPN script configurations — Review on_connect and script directives within Remote Access Profiles for unauthorized entries
• Hunt for IOCs — Search endpoint logs for GUID-named .cmd files in FortiClient’s logsTracescripts path and anomalous fortitray.exe process chains
• Rotate browser credentials — Treat all credentials and session cookies on managed endpoints as potentially compromised

Organizations relying on FortiClient EMS should treat this as a high-priority incident response trigger, given that a single EMS compromise translates to fleet-wide exposure across every managed endpoint.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.