CVE-2026-35616

Name of the Vulnerable Software and Affected Versions FortiClient EMS versions 7.2.0 through 7.2.2 FortiClient EMS versions 7.4.x

Description An improper access control vulnerability exists in the FortiClient Enterprise Management Server (EMS) that allows an unauthenticated remote attacker to execute arbitrary code or commands with SYSTEM-level privileges. The issue stems from a SQL Injection (CWE-89) within the FCT DAS.exe (Data Analytics Service) component, where the service fails to sanitize input in the DAS messaging protocol. Attackers can send specifically crafted HTTP requests to the EMS web server to trigger the xp cmdshell extended stored procedure in the underlying Microsoft SQL Server, jumping from the database layer to the operating system.

This flaw has been exploited in the wild, with approximately 100 internet-exposed instances observed. Threat actors, including the group Storm-1175, have used this as a launchpad to deploy Medusa Ransomware and EKZ Infostealer. In some campaigns, attackers subverted the EMS patch distribution engine to push the infostealer to all managed endpoints disguised as an official security patch. The EKZ Infostealer targets browser credentials and session cookies from Chromium and Gecko-based browsers via PowerShell scripts.

Recommendations Upgrade FortiClient EMS to version 7.2.3 or 7.4.1, or apply the specific emergency hotfix provided by Fortinet for the affected build. Restrict access to management ports (typically 443 and 10443) to trusted IP addresses only. Remove the EMS server from direct internet exposure and require VPN access or strict allowlists. Implement network segmentation to limit administrative access to specific management VLANs. Audit SQL Server logs for unauthorized execution of xp cmdshell or sp configure. Scan the EMS web root directory for unauthorized .php or .asp files. Verify that no unauthorized endpoint policies have been created to disable real-time protection or cloud sandboxing. Rotate and reset administrative credentials and keys, and enforce multi-factor authentication (MFA) for admin accounts.