CVE-2026-21643: Fortinet FortiClient EMS SQL injection

CVE-2026-21643 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-04-13

FortiClient EMS is a management solution used by organizations to oversee and secure endpoint devices. A critical security flaw allows an unauthenticated attacker to send malicious requests over the network to take control of the management server. This could lead to full system compromise, unauthorized access to sensitive endpoint data, and the ability to execute arbitrary commands on the server.

Technologies: Fortinet FortiClient EMS. Vendors: Fortinet.

Quick answers

Is CVE-2026-21643 exploited in the wild?
Yes. CVE-2026-21643 is known to be exploited in the wild, first recorded on 13 April 2026. Treat it as urgent.
How severe is CVE-2026-21643?
Critical severity, with a CVSS score of 9.8, published 13 April 2026.
Which products and versions are affected?
Fortinet FortiClient EMS 7.4.0 through 7.4.4.
Is there a fix for CVE-2026-21643?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-21643 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-21643?
Check whether you run Fortinet FortiClient EMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability (CWE-89) exists in Fortinet FortiClient EMS due to improper neutralization of special elements used in SQL commands. The flaw is reachable via specifically crafted HTTP requests sent to the server. Because the vulnerability does not require authentication or user interaction, a remote attacker can exploit it to achieve unauthorized code execution or command injection on the underlying system. The vulnerability has been observed being exploited in the wild and affects versions 7.4.0 through 7.4.4. Users are advised to upgrade to version 7.4.5 or later.

Affected products

  • Fortinet FortiClient EMS 7.4.0 through 7.4.4

Timeline

  • 2026-02-06: disclosed: Initial disclosure by Fortinet
  • 2026-04-13: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2026-04-13: exploited: Confirmed active exploitation in the wild

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.