Attackers Leverage FortiClient EMS Flaw to Deploy Infostealers

A known improper access control vulnerability in FortiClient Enterprise Management Server (EMS) is being actively exploited by malicious actors. This flaw, identified as CVE-2026-35616, allows attackers to bypass API authentication. They are then able to deliver infostealing malware to enterprise devices, disguised as legitimate Fortinet updates.