Listen to this Post
Introduction:
A recently disclosed unauthenticated API authentication bypass vulnerability in FortiClient Endpoint Management Server (EMS), tracked as CVE‑2026‑35616, is being actively exploited by threat actors. Attackers leverage this flaw to issue privileged requests, turning the management server into a remote code execution (RCE) platform that can push malicious payloads to every managed endpoint. The campaign, observed by Arctic Wolf Labs, delivers a novel credential‑stealing malware dubbed “EKZ” disguised as a fake Fortinet security patch.
Learning Objectives:
- Understand the technical mechanics of CVE‑2026‑35616 and how unauthenticated API bypass leads to RCE on FortiClient EMS.
- Learn to detect indicators of compromise (IoCs) associated with EKZ malware and the fake patch deployment chain.
- Acquire step‑by‑step mitigation and hardening techniques for FortiClient EMS, including API access controls, network segmentation, and log forensics.
You Should Know:
- Understanding CVE‑2026‑35616 – API Authentication Bypass to RCE
The vulnerability resides in the FortiClient EMS API authentication mechanism. By crafting a specific HTTP request that omits or manipulates the required authentication token, an unauthenticated attacker can invoke privileged API endpoints. These endpoints allow the attacker to execute arbitrary commands on the EMS host, and subsequently push software or scripts to all enrolled endpoints.
Step‑by‑step guide to understanding the attack flow:
- Reconnaissance: Attacker scans for exposed FortiClient EMS web interfaces (default ports 443, 8080, 8013).
- Exploit: Sends a POST request to `/api/v1/` with a manipulated `Authorization` header or a special `X-Forwarded-For` value that tricks the API into treating the request as internal.
- Privilege escalation: The bypass grants access to endpoints like `/api/v1/system/command` where a `cmd=whoami` or `powershell -enc …` can be executed.
- Lateral movement: Using the EMS’s trusted relationship with endpoints, the attacker schedules a “fake patch” task that downloads and runs EKZ malware.
Linux / Windows command to simulate detection (authorized testing only):
Linux – check for unexpected EMS API calls in access logs grep -E "POST /api/v1/(system|endpoint|task)" /var/log/forticlient/ems/access.log | grep -v "200"
Windows – search IIS logs for anomalous API patterns findstr /i "POST /api/v1" C:\FortiClient\EMS\logs\W3SVC1.log | findstr /v "200 0 0"
- EKZ Malware Analysis – Credential Stealing and Persistence
EKZ is a .NET‑based infostealer that targets browser credentials, VPN session tokens, and saved RDP passwords. It uses process injection into `explorer.exe` and establishes persistence via a scheduled task named FortiUpdateTask.
Step‑by‑step guide to identifying EKZ on endpoints:
- Check for malicious scheduled tasks:
`schtasks /query | findstr FortiUpdateTask` (Windows)
- Look for injected processes: Use Sysinternals Process Explorer – inspect `explorer.exe` for unusual threads or loaded modules from
%Temp%\.tmp. - Analyze network traffic: EKZ beacons to `hxxp://185.130.5.253:8080/update` (example IoC – verify with threat intel).
- Extract indicators from memory:
Dump lsass and scan for creds rundll32.exe C:\windows\system32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\temp\lsass.dmp full
- Emergency Mitigation – Isolate and Patch FortiClient EMS
Fortinet has released an out‑of‑band patch for CVE‑2026‑35616. If patching is not immediately possible, apply these temporary workarounds.
Step‑by‑step guide to harden EMS:
- Restrict API access by source IP: Use Windows Firewall or an upstream WAF to allow only trusted management subnets to port 443 and 8013.
New-NetFirewallRule -DisplayName "Block EMS API from untrusted" -Direction Inbound -Protocol TCP -LocalPort 443,8013 -Action Block -RemoteAddress Any Then add allow rule for trusted IPs New-NetFirewallRule -DisplayName "Allow trusted IPs to EMS" -Direction Inbound -Protocol TCP -LocalPort 443,8013 -Action Allow -RemoteAddress 192.168.10.0/24
- Disable unneeded API endpoints (if configuration allows): Edit `C:\Program Files\Fortinet\EMS\conf\ems.conf` – set `api.enabled=false` and restart the service.
- Apply the official patch immediately – download from Fortinet support portal only (do not trust third‑party “patch” links).
- Detecting Fake Patch Campaigns – Endpoint and Network Hunting
Attackers used a social engineering lure: an email posing as Fortinet security advisory with a link to a fake portal fortinet-update[.]com. The downloaded executable `FortiPatch_2026-03.exe` drops EKZ.
Step‑by‑step hunting queries:
- SIGMA rule for Sysmon (Windows):
title: Fake Fortinet Patch Execution detection: selection: Image|endswith: '\FortiPatch_2026-03.exe' CommandLine|contains: '--silent' condition: selection
- Linux (if EMS on Linux – rare but possible):
`find / -name “FortiPatch” -type f -exec sha256sum {} \;`
– Network‑based detection: Snort/Suricata rule for EKZ C2:alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"EKZ C2 beacon"; content:"/update"; http_uri; flow:to_server,established; sid:1000001;)
- Post‑Exploitation Forensics – What to Do After a Compromise
If you suspect the EMS server or any endpoint is compromised, follow this incident response workflow.
Step‑by‑step IR guide:
- Isolate the EMS server from the network immediately (disable NIC or block outbound traffic).
- Collect forensic artifacts:
- EMS logs: `C:\FortiClient\EMS\logs\ems.log` and `tomcat.log`
– Windows Event IDs: 4688 (process creation), 4624 (logon), 7045 (service installation) - Memory dump of EMS and affected endpoints.
- Revoke all compromised credentials – reset all domain/admin passwords and FortiClient VPN secrets.
- Reimage compromised hosts – EKZ may have deployed backdoors beyond simple infostealer.
- Long‑term Hardening for FortiClient EMS and API Security
To prevent similar flaws, implement defense‑in‑depth controls around the EMS API.
Step‑by‑step hardening checklist:
- Enable MFA for all EMS administrative access (even internal).
- Deploy a reverse proxy (nginx, HAProxy) in front of the EMS API with strict allowlists and request validation.
- Monitor API call anomalies using custom scripts:
Watch for high-frequency command execution via API tail -f /var/log/ems/api.log | grep --line-buffered "command" | while read line; do echo "$(date): $line"; done
- Segment EMS management plane from production networks using VLANs and Azure/AWS security groups (if cloud‑hosted).
- Regular vulnerability scans – use Nuclei template to test for CVE‑2026‑35616:
id: CVE-2026-35616 requests:</li> <li>method: POST path: /api/v1/system/command headers: Authorization: "Bearer dummy" body: "cmd=whoami" matchers:</li> <li>type: word words:</li> <li>"nt authority"
What Undercode Say:
- Key Takeaway 1: Unauthenticated API bypass vulnerabilities in endpoint management platforms (EMS, EDR, RMM) are gold for attackers because they turn a single compromised server into a fleet‑wide RCE cannon. This is not just a Fortinet issue – any centralized management API must be treated as a crown jewel and hardened with zero‑trust principles.
- Key Takeaway 2: The “fake patch” social engineering angle is highly effective because IT teams are conditioned to trust security vendor notifications. Always verify patches through official portals, never through emailed links, and deploy code signing enforcement to reject unsigned executables.
Analysis (10 lines):
The exploitation of CVE‑2026‑35616 demonstrates a dangerous convergence: a high‑severity API flaw (CVSS likely 9.8) combined with a supply‑chain style delivery mechanism. By masquerading as a Fortinet patch, attackers bypass user suspicion and endpoint controls that typically block untrusted downloads. Arctic Wolf’s observation that the EKZ malware focuses on credential theft suggests the ultimate goal is lateral movement and persistent access, not just data exfiltration. Organizations using FortiClient EMS should assume that any endpoint that received a “patch” in the last 30 days might be compromised. The incident also highlights a broader systemic risk: EMS servers are often poorly monitored compared to public‑facing web servers, yet they hold the keys to every managed host. Future attacks will likely target similar API bypasses in other EDR, VPN, and MDM platforms. Defenders must prioritize API security testing, log centralization, and behavioral detection for anomalous command execution from management servers.
Prediction:
-
- This breach will accelerate industry adoption of API security gateways and runtime‑self‑protection for management consoles.
-
- Expect a surge in supply‑chain style attacks using fake patches from trusted vendors, as EKZ proves the model works.
-
- Regulatory bodies (e.g., SEC, GDPR authorities) will impose fines on organizations that fail to patch critical API vulnerabilities within 48 hours of disclosure.
-
- Open‑source detection rules (SIGMA, YARA) for EKZ and similar infostealers will mature rapidly, improving community defense.
-
- Smaller MSPs using FortiClient EMS without dedicated security staff are at highest risk and may face catastrophic client‑wide breaches in the coming weeks.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Forticlient Cybersecuritynews – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
