Search: CVE-2026-35616

CVE-2026-35616 is a critical improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6. It allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests. This vulnerability has a high CVSS score of 9.1 and is known to be exploited in the wild. An official fix is available to remediate this issue.

Researchers uncovered an AI-driven intrusion ecosystem operated by affiliates of INC and The Gentlemen ransomware groups via seven exposed command-and-control servers. The operators integrated commercial AI models, exploited edge devices at scale, and compromised thousands of targets, primarily in the US industrial manufacturing and healthcare sectors. The infrastructure included multiple custom encryptor builds and evidence of active victim encryption. Operational security failures exposed source code, credentials, AI session logs, and victim data. The campaign demonstrates advanced ransomware-as-a-service operations leveraging AI and custom tooling.

Malware#simplehelp#phantom frameworkUnited States