Fortinet Releases Emergency Patch After FortiClient EMS Bug Is Exploit
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-21643 | Unauthenticated SQL Injection to Code Execution in Fortinet FortiClient EMS 7.4.4 CVE-2026-21643 is a critical SQL injection flaw (CWE-89, improper neutralization of special elements used in an SQL command) in Fortinet FortiClient EMS 7.4.4, scored 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An unauthenticated remote attacker can trigger it by sending specifically crafted HTTP requests to the EMS server, and successful injection allows execution of unauthorized code or commands, yielding high confidentiality, integrity, and availability impact. Any organization running the affected FortiClient EMS release is exposed, with internet-facing EMS management servers at greatest risk. Exploitation is confirmed: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-04-13, EPSS assigns a 94.1% probability of exploitation within 30 days (99.9th-plus percentile), and news reports describe active zero-day exploitation that prompted Fortinet to issue emergency patches, alongside related FortiClient EMS hotfixes (CVE-2026-35616). Do: Upgrade affected FortiClient EMS 7.4.4 deployments using the emergency patch/hotfix Fortinet has released (see the Fortinet PSIRT advisory for fixed builds), prioritizing internet-exposed EMS servers; federal agencies must satisfy the BOD 22-01 requirement per the KEV listing. Until patched, restrict public exposure of the EMS web interface and review web access and database logs for signs of crafted HTTP requests or unexpected command execution. | 9.8 | 94% | KEV PoC |
| largeon the order of tens of thousands of FortiClient EMS server deployments (estimate) | |
| CVE-2026-35616 | Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6 Fortinet FortiClient EMS versions 7.4.5 through 7.4.6 contain an improper access control flaw (CWE-284) that allows an unauthenticated attacker to execute unauthorized code or commands by sending crafted requests over the network. The attack requires no authentication, privileges, or user interaction, making any reachable EMS management server a direct target. A successful attacker gains code execution on the EMS host, and reported campaigns have used the flaw to deploy a credential stealer. Any organization running FortiClient EMS 7.4.5 or 7.4.6 is affected. The flaw is being exploited in the wild: it was added to CISA KEV on 2026-04-06, carries a 90.7% EPSS probability of exploitation within 30 days, and Fortinet has released emergency hotfixes. Do: Upgrade FortiClient EMS off 7.4.5/7.4.6 using the fixed release or emergency hotfix per Fortinet's advisory (the available data does not specify the fixed version number), prioritizing internet-exposed servers; U.S. federal agencies must follow BOD 22-01. Until patched, restrict EMS management access to trusted networks or VPN and monitor for credential-stealer activity on managed endpoints. Given confirmed in-the-wild exploitation, assume possible compromise and hunt for indicators on both EMS hosts and endpoints it manages. | 9.8 | 91% | KEV |
| large≈10,000–100,000 EMS deployments (order-of-magnitude estimate; exact counts not in the data) |
Full article348 words · extracted from infosecurity-magazine.com · click to collapse
Fortinet customers have been urged to update their FortiClient Enterprise Management Server (EMS) products after the vendor was forced to issue an emergency patch over the weekend.
CVE-2026-35616 is a critical (CVSS 9.1) improper access control vulnerability which could allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
“Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6,” the vendor said. “Upcoming FortiClientEMS 7.4.7 will also include a fix for this issue. In the meantime, the hotfix above is sufficient to prevent it entirely.”
Cybersecurity vendor Defused explained that it had seen the vulnerability being exploited in zero-day attacks earlier last week and notified Fortinet accordingly.
“The vulnerability allows an unauthenticated attacker to bypass API authentication and authorization entirely, unauthorized code or commands via crafted requests,” Defused said in a social media post.
Second Critical Flaw in a Week
Defused also discovered another critical vulnerability in the FortiClient EMS platform last week, also being exploited in the wild.
CVE-2026-21643 is an SQL injection flaw with a CVSS score of 9.8 which could allow unauthenticated attackers to execute unauthorized code via specifically crafted HTTP requests.
By hijacking organizations’ endpoint management infrastructure, threat actors could push malicious updates to endpoints and launch deeper attacks into cloud systems, for possible espionage and ransomware.
For that specific vulnerability, customers were urged to upgrade to version 7.4.5 or later, or at least disconnect the administrative web interface from the internet. Indicators of compromise (IoCs) included HTTP 500 errors on the /api/v1/init_consts endpoint; unusual database error messages in PostgreSQL logs; and unauthorized remote monitoring and management tools.
Endpoint management solutions are a popular target for threat actors given the access they provide to company device fleets. This can be weaponized in ransomware, cyber espionage or destructive attacks.
In 2024, Fortinet was forced to patch a critical SQL injection vulnerability in FortiClientEMS which could have enabled remote code execution (RCE) on targeted servers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/fortinet-emergency-patch-ems-bug/