Week in Review: Infostealer Dropped via FortiClient EMS Flaw, Exploited Trend Micro Apex One Flaw

Why It Matters

Unpatched or exploited vulnerabilities can compromise millions of devices, inflating breach costs and eroding trust, while the DBIR data signals that organizations must evolve their risk‑management approaches to keep pace with AI‑enhanced attacks.

Key Takeaways

• FortiClient EMS CVE‑2026‑35616 enables broad‑scale infostealer attacks
• Trend Micro Apex One CVE‑2026‑34926 actively exploited in zero‑day attacks
• Microsoft patches high‑severity SharePoint RCE (CVE‑2026‑45659) across three server versions
• Phishing campaigns misuse Adobe A/B testing and LinkedIn themes to trick professionals
• Verizon DBIR 2026 analyzes 31,000 incidents, highlighting rising AI‑driven vulnerabilities

Pulse Analysis

Enterprise security teams faced a stark reminder this week that vulnerability management is no longer a routine checklist. A known improper‑access‑control flaw in FortiClient’s EMS (CVE‑2026‑35616) was weaponized to deliver a multi‑purpose infostealer, compromising endpoint data at scale. Simultaneously, Trend Micro’s Apex One platform suffered a zero‑day relative‑path‑traversal exploit (CVE‑2026‑34926), and Microsoft rushed patches for a high‑severity SharePoint remote‑code‑execution bug (CVE‑2026‑45659). These incidents illustrate how quickly attackers can pivot from disclosed weaknesses to active campaigns, forcing organizations to accelerate patch cycles and bolster detection capabilities.

Beyond the technical exploits, the week highlighted a broader shift toward AI‑augmented threat vectors and socially engineered attacks that exploit trusted services. Researchers uncovered phishing operations that co‑opt Adobe’s A/B testing infrastructure and craft LinkedIn‑styled emails, increasing credibility and click‑through rates. Cisco’s research on multi‑turn attacks against large language models and the Verizon 2026 Data Breach Investigations Report—covering more than 31,000 incidents—both point to a surge in sophisticated, AI‑driven tactics that evade traditional signatures and overwhelm alert fatigue. Boards are demanding risk expressed in dollar terms, underscoring the need for quantifiable impact assessments.

For security leaders, the imperative is clear: adopt a risk‑based, automation‑first vulnerability program that prioritizes zero‑day threats and integrates real‑time threat intelligence. Continuous monitoring of exploit disclosures, rapid patch deployment, and leveraging AI for triage can shrink dwell time. Simultaneously, organizations must tighten phishing defenses by validating third‑party services and educating users on novel social‑engineering lures. Translating these technical risks into business‑level metrics will help secure executive buy‑in and protect the expanding attack surface shaped by AI and remote work ecosystems.