Daily Cybersecurity News - April 5, 2026
Fortinet Patches Critical API Flaw
CriticalExecutive Summary
Fortinet has released out-of-band patches for a critical vulnerability in FortiClient EMS, identified as CVE-2026-35616, which is confirmed to be actively exploited in the wild.
The flaw allows an unauthenticated attacker to bypass API access controls, leading to privilege escalation.
Vulnerability Details
- Affected Product: FortiClient EMS versions 7.4.5 and 7.4.6
- Identifier: CVE-2026-35616
- CVSS Score: 9.1 (Critical)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Immediate action is required; this is an emergency response situation due to active exploitation.
- Attack Vector: An unauthenticated, remote attacker can send specially crafted requests to the API to bypass authentication and execute unauthorized code or commands.
- Ease of Exploit: Low. The attack does not require authentication or user interaction, making internet-exposed systems highly vulnerable.
Action Plan
- Immediate Action: Apply the emergency hotfixes provided by Fortinet for versions 7.4.5 and 7.4.6. A permanent fix will be included in the upcoming FortiClient EMS 7.4.7.
- Workaround: If patching is not immediately possible, restrict access to the FortiClient EMS administration interface to trusted networks and monitor for unauthorized activity.
- Detection: Monitor for unusual or unauthorized API requests and unexpected configuration changes on the FortiClient EMS server.
Relevant professional terms
- Privilege Escalation
- A type of cyberattack where an attacker exploits vulnerabilities to gain elevated access to resources and permissions that are normally restricted to them.
- Out-of-Band Patch
- A software update released outside of the normal, scheduled release cycle to urgently address a critical or actively exploited vulnerability.
Source: The Hacker News
North Korean Actors Hijack NPM Package
Executive Summary
North Korean threat actors (UNC1069) executed a supply chain attack by hijacking the account of a lead maintainer for the popular Axios npm package. The goal was to distribute a cross-platform remote access trojan (RAT) to developers who downloaded the compromised library.
Key TTPs
- Initial Access: A highly-targeted social engineering campaign impersonated a legitimate company, luring the developer into a fake Microsoft Teams meeting that prompted a malicious update.
- Execution: Attackers used a stolen npm token to publish malicious versions of Axios, which included a phantom dependency that executed a RAT via a postinstall script.
- Defense Evasion: The malicious dropper script used multi-layer obfuscation, and the malware was designed to self-destruct after execution to erase evidence.
Campaign Analysis
This attack highlights the increasing sophistication of social engineering campaigns targeting open-source maintainers. By compromising a foundational package like Axios, attackers gain access to a massive downstream ecosystem of applications and CI/CD pipelines.
Targeting & Infrastructure
- Target Profile: Developers and maintainers of highly popular open-source software projects.
- Infrastructure: Malicious npm packages (
axios@1.14.1,axios@0.30.4,plain-crypto-js@4.2.1).
Relevant Terms
- Supply Chain Attack: An attack strategy that targets less-secure elements in a software supply network, such as third-party libraries, to compromise a final product.
- npm (Node Package Manager): The default package manager for the JavaScript runtime environment Node.js, used by developers to share and reuse code.
Source: BleepingComputer