Cybersecurity articles tagged #FortiClient EMS on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/lynx-ransomware-linked-to-massive-fortibleed-credential-thefthttps://runtimerebel.com/blog/lynx-ransomware-linked-to-massive-fortibleed-credential-theftThreat actors behind Lynx and INC ransomware leverage FortiBleed campaign to harvest over 440,000 Fortinet VPN credentials via CVE-2023-48788 exploits.Thu, 02 Jul 2026 07:36:16 GMTLynx RansomwareINC RansomwareCVE-2023-48788FortinetCredential TheftFortiClient EMShttps://runtimerebel.com/blog/cve-2026-35616-forticlient-ems-exploit-delivers-ekz-infostealerhttps://runtimerebel.com/blog/cve-2026-35616-forticlient-ems-exploit-delivers-ekz-infostealerAttackers are actively exploiting CVE-2026-35616, an authentication bypass in FortiClient EMS, to deploy the EKZ infostealer. Protect your organization now.Thu, 28 May 2026 20:53:31 GMTCVE-2026-35616FortiClient EMSEKZ InfostealerAuthentication BypassCredential StealerFortinethttps://runtimerebel.com/blog/forticlient-ems-critical-flaw-exploited-for-credential-stealinghttps://runtimerebel.com/blog/forticlient-ems-critical-flaw-exploited-for-credential-stealingThreat actors are actively exploiting a critical, patched FortiClient EMS vulnerability to deploy credential-stealing malware, bypassing trusted endpoint security.Thu, 28 May 2026 17:21:27 GMTFortiClient EMSCredential StealerEndpoint SecurityExploitationMalwarehttps://runtimerebel.com/blog/cve-2023-48788-critical-forticlient-ems-rce-under-active-exploitationhttps://runtimerebel.com/blog/cve-2023-48788-critical-forticlient-ems-rce-under-active-exploitationExploitation of CVE-2023-48788 in FortiClient EMS allows unauthenticated remote code execution. Administrators must patch to version 7.2.3 or 7.0.11 immediately.Thu, 28 May 2026 13:26:51 GMTFortinetCVE-2023-48788RCEFortiClient EMSSQL Injectionhttps://runtimerebel.com/blog/cisa-kev-update-fortinet-forticlient-ems-cve-2026-21643-under-attackhttps://runtimerebel.com/blog/cisa-kev-update-fortinet-forticlient-ems-cve-2026-21643-under-attackCISA adds six flaws to the KEV catalog, including a critical unauthenticated SQL injection in Fortinet FortiClient EMS (CVE-2026-21643). Patch immediately.Tue, 14 Apr 2026 08:40:46 GMTFortinetCVE-2026-21643CISA KEVSQL InjectionFortiClient EMShttps://runtimerebel.com/blog/cve-2026-35616-fortinet-forticlient-ems-vulnerability-kev-alerthttps://runtimerebel.com/blog/cve-2026-35616-fortinet-forticlient-ems-vulnerability-kev-alertCISA adds CVE-2026-35616 affecting Fortinet FortiClient EMS to its Known Exploited Vulnerabilities catalog. Learn how to mitigate this access control flaw.Mon, 06 Apr 2026 16:23:16 GMTCVE-2026-35616FortinetFortiClient EMSKEVAccess Controlhttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2026-35616-mitigation-guidehttps://runtimerebel.com/blog/forticlient-ems-rce-via-cve-2026-35616-mitigation-guideFortinet releases emergency patches for CVE-2026-35616, a critical SQL injection flaw in FortiClient EMS exploited to achieve unauthenticated RCE.Sun, 05 Apr 2026 20:12:25 GMTCVE-2026-35616FortinetFortiClient EMSRCEActive Exploitationhttps://runtimerebel.com/blog/cve-2026-35616-critical-forticlient-ems-api-bypass-exploitedhttps://runtimerebel.com/blog/cve-2026-35616-critical-forticlient-ems-api-bypass-exploitedFortinet releases out-of-band patches for CVE-2026-35616, a critical API access bypass in FortiClient EMS enabling unauthenticated privilege escalation.Sun, 05 Apr 2026 08:18:00 GMTCVE-2026-35616FortiClient EMSFortinetPrivilege Escalationhttps://runtimerebel.com/blog/fortinet-forticlient-ems-critical-sqli-flaw-under-active-exploitationhttps://runtimerebel.com/blog/fortinet-forticlient-ems-critical-sqli-flaw-under-active-exploitationCritical SQL injection in FortiClient EMS allows unauthenticated remote code execution. Active exploitation detected, immediate patching required.Tue, 31 Mar 2026 12:31:11 GMTFortinetFortiClient EMSSQL InjectionRCEExploitationhttps://runtimerebel.com/blog/cve-2023-48788-forticlient-ems-rce-via-sql-injection-exploithttps://runtimerebel.com/blog/cve-2023-48788-forticlient-ems-rce-via-sql-injection-exploitExploitation of a critical RCE vulnerability (CVE-2023-48788) in Fortinet FortiClient EMS has been confirmed. Learn how to detect and mitigate this threat.Mon, 30 Mar 2026 08:40:09 GMTCVE-2023-48788FortinetFortiClient EMSRCESQL Injection