60
CVE-2026-21643
KEV PoC largeUnauthenticated SQL Injection to Code Execution in Fortinet FortiClient EMS 7.4.4
CISA: Fortinet FortiClient EMS SQL Injection Vulnerability
CVSS 3.1
9.8 critical
EPSS
94%p100
Published
()
KEV added
AI analysis
CVE-2026-21643 is a critical SQL injection flaw (CWE-89, improper neutralization of special elements used in an SQL command) in Fortinet FortiClient EMS 7.4.4, scored 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can trigger it by sending specifically crafted HTTP requests to the EMS server, and successful injection allows execution of unauthorized code or commands, yielding high confidentiality, integrity, and availability impact. Any organization running the affected FortiClient EMS release is exposed, with internet-facing EMS management servers at greatest risk. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-04-13, EPSS assigns a 94.1% probability of exploitation within 30 days (99.9th-plus percentile), and news reports describe active zero-day exploitation that prompted Fortinet to issue emergency patches, alongside related FortiClient EMS hotfixes (CVE-2026-35616).
What to do: Upgrade affected FortiClient EMS 7.4.4 deployments using the emergency patch/hotfix Fortinet has released (see the Fortinet PSIRT advisory for fixed builds), prioritizing internet-exposed EMS servers; federal agencies must satisfy the BOD 22-01 requirement per the KEV listing. Until patched, restrict public exposure of the EMS web interface and review web access and database logs for signs of crafted HTTP requests or unexpected command execution.
Affected
| Fortinet FortiClient EMS | 7.4.4 (version listed by CISA; fixed builds per the Fortinet PSIRT advisory/emergency patch) |
Estimated exposure
largeon the order of tens of thousands of FortiClient EMS server deployments (estimate) — No install counts are provided in the source data, so this is an order-of-magnitude estimate based on the typical one-EMS-server-per-organization deployment model, Fortinet's large enterprise customer base, and past public…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CISA Known Exploited Vulnerability
- Affected
- Fortinet FortiClient EMS
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Due date
- Ransomware use
- Unknown
- Vendors
- fortinet
- Products
- forticlientems
- Weakness
- CWE-89
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news14 stories
60
April 2026 CVE Landscape
60
CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software
60
U.S. CISA adds Adobe, Fortinet, Microsoft Windows, Microsoft Exchange Server flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
60
60
60
60