14 days. Not the patch window.
Scattered Spider is exploiting a zero-day Gogs RCE and CVE-2026-35616 in FortiClient EMS for remote access and malware distribution. The technical mechanics involve leveraging these vulnerabilities to gain initial access, then moving laterally within the network.
This is not a vulnerability problem, but a patch governance failure. According to IBM's Cost of a Data Breach Report 2025, the average cost of a breach is $4.44M, with 42% of exploited vulnerabilities being weaponized before public disclosure.
The defensive math: -> Prioritize updating FortiClient EMS and Gogs instances to prevent potential breaches, with a success metric of 95% patch compliance within 7 days. -> Implement a vulnerability management process that includes continuous monitoring and rapid patching, aiming to reduce the median patch-to-exploit window to under 14 days. -> Review identity and access management policies to limit lateral movement in case of a breach, targeting a 30% reduction in dwell time.
Can your team patch critical vulnerabilities faster than Scattered Spider can exploit them?