A critical vulnerability in FortiClient Endpoint Management Server, tracked as CVE-2026-35616, is being actively exploited by threat actors to deploy information-stealing malware. This flaw, which has a CVSS score of 9.1, can be remotely exploited without authentication, allowing for remote code execution. The vulnerability was patched in April, but unpatched systems remain vulnerable to attack. Arctic Wolf has reported that the flaw is being used in fresh attacks to deploy malware, highlighting the need for prompt patching and mitigation. The exploitation of this vulnerability expands the active attack surface, making it essential for organizations to prioritize patching based on their exposure and evidence of exploitation1. This vulnerability poses a significant risk to unpatched systems, and practitioners should take immediate action to patch and protect their systems.