The exploitation of CVE-2026-35616 in FortiClient Enterprise Management Server (EMS) has entered a new and dangerous phase with the discovery of the EKZ credential stealer. This vulnerability, which allows for an unauthenticated bypass of security controls, is being actively leveraged by sophisticated threat actors to gain a foothold in enterprise networks. Once the bypass is achieved, the attackers deploy the EKZ stealer, a previously undocumented piece of malware designed to harvest a wide range of sensitive information, including browser credentials, VPN configurations, and session tokens. The impact of this campaign is particularly severe because FortiClient EMS is often used to manage the security posture of thousands of remote endpoints. A compromise of the EMS server effectively grants the attacker control over the entire fleet of managed devices. According to reports from BleepingComputer, the EKZ stealer is highly modular, allowing its operators to push additional payloads such as ransomware or backdoors once the initial data harvest is complete. The speed at which this vulnerability is being exploited suggests that threat actors were either aware of the flaw prior to its public disclosure or were able to rapidly reverse-engineer the patch. This 'N-day' exploitation window is a critical challenge for defenders, who must often navigate complex change management processes before applying patches to critical infrastructure. To mitigate the risk, organizations should not only apply the necessary updates but also implement robust monitoring for any unusual activity originating from their EMS servers. The use of the EKZ stealer highlights the ongoing shift toward 'identity-centric' attacks, where the goal is not just to disrupt operations but to steal the credentials necessary for long-term, persistent access. As the perimeter continues to dissolve, the security of management infrastructure like FortiClient EMS becomes a paramount concern for enterprise resilience.