FortiClient EMS Critical Flaw Actively Exploited to Steal Credentials

Threat actors are actively exploiting a critical vulnerability in Fortinet's FortiClient Endpoint Management Server (EMS) to deploy credential-stealing malware across managed enterprise environments, according to The Hacker News. Fortinet has released a patch, but unpatched deployments are being targeted right now.

What Happened

Attackers are abusing the trusted position of EMS — the server that centrally manages, configures, and pushes software to every enrolled endpoint — to deliver credential-stealing malware across the managed fleet. The campaign targets FortiClient EMS deployments that have not yet applied the available patch for the critical flaw.

This attack pattern is particularly dangerous: because EMS is explicitly trusted by every endpoint it manages, malware delivered through it can reach machines that would otherwise reject untrusted executables. The EMS server itself becomes the attack vector against the fleet it is designed to protect. Observed payloads are focused on credential theft — harvesting domain accounts, local credentials, and VPN secrets that enable deep lateral movement.

Why It Matters

FortiClient EMS is standard infrastructure in enterprise and mid-market environments. If you run it, the blast radius of a compromised or exploited EMS server is your entire managed endpoint estate — not a single machine.

The threat model here is aggressive:

• One server, every endpoint. EMS has legitimate authority to deploy to all managed machines. Attackers inherit that authority.
• Credential theft unlocks the network. Stolen domain and VPN credentials are what attackers need to move laterally, escalate privilege, and establish persistence.
• Active exploitation means it's already happening. This is not a theoretical risk or a proof-of-concept — campaigns are underway against unpatched deployments.

Organizations that delay patching are actively being targeted.

What to Do

1. Patch now. Verify your FortiClient EMS version and apply Fortinet's patch immediately. Do not wait for a scheduled maintenance window. Check Fortinet's PSIRT advisories for the specific CVE, affected versions, and fixed builds.

2. Audit EMS deployment logs. Review recent software deployment events for anything you did not authorize. Look for unexpected policy changes, new deployment packages, or connections to the EMS management interface from unfamiliar IPs.

3. Hunt on managed endpoints. Check endpoints for signs of credential harvesting: unexpected LSASS access, modifications to credential stores, or anomalous outbound connections that could indicate exfiltration.

4. Isolate if you cannot patch immediately. The EMS management interface must not be internet-facing. Lock it down to dedicated admin jump hosts and block all other access while you arrange emergency patching.

5. Treat recent deployments as suspect. If your EMS server was reachable and unpatched, audit everything it pushed to endpoints over the past several weeks and validate integrity before trusting those machines.

If you run a SIEM, add detection for unusual process execution originating from the FortiClient EMS agent on endpoints — legitimate EMS activity has a narrow, predictable profile.