Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-21643

Published 2026-02-06

Updated 5 months ago

Vendor/s

Fortinet

Product/s

FortiClient EMS

Version/s

7.4.4

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.8

/ 10

Critical

Severity Details

Base score

9.8 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-21643 is a critical SQL injection vulnerability in Fortinet FortiClient EMS 7.4.4 allowing unauthenticated RCE. Immediate patching is required.

## Why this matters

CVE-2026-21643 is a critical SQL injection vulnerability in Fortinet FortiClient EMS with a CVSS score of 9.8. Because it allows unauthenticated attackers to execute unauthorized code via specially crafted HTTP requests, it poses a severe risk to organizational infrastructure. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog indicates active exploitation in the wild. Security teams must prioritize this because FortiClient EMS serves as a central management point for endpoint security; a compromise here could lead to full network takeover and lateral movement across all managed endpoints.

## CPE

Fortinet

| Product        | Version Start | Version End (excl.) | Status     |
| -------------- | ------------- | ------------------- | ---------- |
| forticlientems | 7.4.4         | 7.4.4               | vulnerable |

## Related weakness (CWE)

CWE-89

## Remediation plan

1

### Apply official patches

Immediately consult the Fortinet PSIRT advisory FG-IR-25-1142 and apply the recommended firmware updates or hotfixes provided by Fortinet to address the SQL injection flaw.

2

### Update affected systems

Ensure that FortiClient EMS installations running version 7.4.4 are upgraded to a patched version as specified in the vendor's release notes to eliminate the vulnerability.

3

### Restrict access

Limit access to the FortiClient EMS administrative interface and HTTP/HTTPS ports to trusted internal IP addresses only, using firewalls or access control lists (ACLs) to reduce the attack surface.

4

### Monitor for exploitation

Review web server logs for suspicious SQL syntax or unusual HTTP requests targeting the EMS server, and monitor for unexpected process executions or outbound connections from the EMS host.

## Detection Guidance

Organizations should monitor HTTP traffic for common SQL injection patterns (e.g., single quotes, semicolons, or UNION SELECT statements) targeting the FortiClient EMS management port. Inspect web server logs for 400 or 500-level errors associated with malformed requests. Additionally, use EDR tools to detect anomalous child processes spawned by the EMS service or unexpected database queries that deviate from established baselines.

## References

[https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 Vendor Advisory ](https://fortiguard.fortinet.com/psirt/FG-IR-25-1142)[https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py Exploit ](https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-21643 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)