Digital shields protecting Fortinet API vulnerabilities and NPM package hijacks.

Daily Cybersecurity News - April 5, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

April 5, 2026 1:45 PM 2 min read

Fortinet Patches Critical API Flaw

Critical

Executive Summary

Fortinet has released out-of-band patches for a critical vulnerability in FortiClient EMS, identified as CVE-2026-35616, which is confirmed to be actively exploited in the wild. The flaw allows an unauthenticated attacker to bypass API access controls, leading to privilege escalation.

Vulnerability Details

Affected Product: FortiClient EMS versions 7.4.5 and 7.4.6
Identifier: CVE-2026-35616
CVSS Score: 9.1 (Critical)
Exploitation Status: Actively Exploited

Risk & Impact

Triage: Immediate action is required; this is an emergency response situation due to active exploitation.
Attack Vector: An unauthenticated, remote attacker can send specially crafted requests to the API to bypass authentication and execute unauthorized code or commands.
Ease of Exploit: Low. The attack does not require authentication or user interaction, making internet-exposed systems highly vulnerable.

Action Plan

Immediate Action: Apply the emergency hotfixes provided by Fortinet for versions 7.4.5 and 7.4.6. A permanent fix will be included in the upcoming FortiClient EMS 7.4.7.
Workaround: If patching is not immediately possible, restrict access to the FortiClient EMS administration interface to trusted networks and monitor for unauthorized activity.
Detection: Monitor for unusual or unauthorized API requests and unexpected configuration changes on the FortiClient EMS server.

Relevant professional terms

Privilege Escalation: A type of cyberattack where an attacker exploits vulnerabilities to gain elevated access to resources and permissions that are normally restricted to them.
Out-of-Band Patch: A software update released outside of the normal, scheduled release cycle to urgently address a critical or actively exploited vulnerability.

Source: The Hacker News

North Korean Actors Hijack NPM Package

Executive Summary

North Korean threat actors (UNC1069) executed a supply chain attack by hijacking the account of a lead maintainer for the popular Axios npm package. The goal was to distribute a cross-platform remote access trojan (RAT) to developers who downloaded the compromised library.

Key TTPs

Initial Access: A highly-targeted social engineering campaign impersonated a legitimate company, luring the developer into a fake Microsoft Teams meeting that prompted a malicious update.
Execution: Attackers used a stolen npm token to publish malicious versions of Axios, which included a phantom dependency that executed a RAT via a postinstall script.
Defense Evasion: The malicious dropper script used multi-layer obfuscation, and the malware was designed to self-destruct after execution to erase evidence.

Campaign Analysis

This attack highlights the increasing sophistication of social engineering campaigns targeting open-source maintainers. By compromising a foundational package like Axios, attackers gain access to a massive downstream ecosystem of applications and CI/CD pipelines.

Targeting & Infrastructure

Target Profile: Developers and maintainers of highly popular open-source software projects.
Infrastructure: Malicious npm packages (axios@1.14.1, axios@0.30.4, plain-crypto-js@4.2.1).

Relevant Terms

Supply Chain Attack: An attack strategy that targets less-secure elements in a software supply network, such as third-party libraries, to compromise a final product.
npm (Node Package Manager): The default package manager for the JavaScript runtime environment Node.js, used by developers to share and reuse code.

Source: BleepingComputer