CVE-2026-21643
Fortinet FortiClient EMS SQL Injection Vulnerability
Description
CVE-2026-21643 is a CRITICAL SQL injection vulnerability in Fortinet FortiClient EMS 7.4.4 with a CVSS 3.1 score of 9.8. By sending specifically crafted HTTP requests, an unauthenticated remote attacker can execute unauthorized code or commands on the vulnerable endpoint management server. Because FortiClient EMS centrally manages and pushes policies to endpoint agents across an organization, successful exploitation of CVE-2026-21643 can expose the entire managed fleet to compromise. CISA has added this FortiClient EMS SQL injection vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2026-04-16, and the EPSS score of 0.33907 (96.97th percentile) indicates a very high likelihood of exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | forticlientems | 7.4.4 |
References
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-21643 is classified under CWE-89 — SQL Injection. This weakness occurs when FortiClient EMS constructs SQL statements by concatenating externally-influenced input from HTTP requests without properly neutralizing special elements such as quotes, comments, or statement terminators. Because the vulnerable code path in FortiClient EMS 7.4.4 does not require authentication, any attacker who can reach the management interface over the network can inject SQL fragments that alter the intended query, leading to unauthorized code or command execution on the database backend.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact Analysis
CVE-2026-21643 carries a CVSS 3.1 score of 9.8 (CRITICAL) with an unchanged scope, reflecting the most severe combination of exploitability and impact. Attack Vector (Network): the flaw is remotely exploitable across the network without any physical or local access, meaning any FortiClient EMS instance with an exposed HTTP interface is reachable by attackers. Attack Complexity (Low): exploitation requires no special conditions — a crafted HTTP request is sufficient. Privileges Required (None) and User Interaction (None): no credentials and no victim action are needed, enabling fully automated, opportunistic attacks. Confidentiality, Integrity, and Availability (all High): a successful SQL injection against FortiClient EMS can expose endpoint inventories, administrator credentials, and policy data; modify or delete records in the management database; and disrupt or disable the endpoint management service, which in turn affects every managed FortiClient agent. With an EPSS score of 33.9% (96.97th percentile) and an active KEV listing, CVE-2026-21643 should be treated as a priority-one incident.
Exploit Maturity
CVE-2026-21643 is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-13 with a tight remediation deadline of 2026-04-16, confirming in-the-wild attacks against FortiClient EMS. Public exploit code is available for CVE-2026-21643 via a proof-of-concept published on GitHub (0xBlackash/CVE-2026-21643), which lowers the bar for opportunistic exploitation significantly. The EPSS score of 33.9% (96.97th percentile) places CVE-2026-21643 among the very top percentile of vulnerabilities for predicted exploitation activity. KEV does not currently list known ransomware use, but unauthenticated SQL injection on an endpoint management platform is a classic foothold for initial access brokers and should be patched immediately.
Remediation
- Follow CISA's KEV directive immediately. Apply mitigations per Fortinet's instructions in advisory FG-IR-25-1142, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of FortiClient EMS if mitigations are unavailable — the remediation deadline was 2026-04-16.
- Upgrade FortiClient EMS off the affected 7.4.4 release. Identify every FortiClient EMS server in your environment and upgrade to the fixed build documented in Fortinet PSIRT advisory FG-IR-25-1142. Do not leave any 7.4.4 instances online, even in staging or DR environments.
- Restrict access to the FortiClient EMS management interface. Until the upgrade is verified, place the EMS HTTP/HTTPS interface behind a VPN, restrict source IPs via firewall ACLs, and block inbound access from untrusted networks. This is a network-layer compensating control for an unauthenticated SQL injection.
- Hunt for indicators of compromise. Review EMS and database logs for unusual HTTP request patterns (UNION-based payloads, stacked queries, time-based delays), new or modified administrator accounts, unexpected policy pushes to endpoints, and outbound connections from the EMS host. Public exploit code for CVE-2026-21643 is available, so assume opportunistic scanning has occurred.
- Rotate credentials and secrets stored on EMS. Given the CRITICAL confidentiality impact of an SQL injection against a management server, rotate database passwords, administrator credentials, API tokens, and any shared secrets used to authenticate to endpoints or upstream Fortinet services.
- Harden against future SQL injection flaws. Adopt the CWE-89 mitigations: require parameterized queries / prepared statements for all database access in custom integrations, enforce least privilege for the EMS database account, and deploy a WAF with SQLi signatures in front of management interfaces as defense-in-depth.
Technical Details
CVE-2026-21643 is an unauthenticated SQL injection vulnerability in the HTTP request handling of Fortinet FortiClient EMS 7.4.4. According to Fortinet and NVD, a specifically crafted HTTP request reaches a code path that constructs an SQL command using attacker-controlled input without proper neutralization of special elements, which is the canonical CWE-89 pattern: externally-influenced data is concatenated into a query string so that meta-characters such as quotes, semicolons, or comment markers change the structure of the query rather than being treated as literal data. Because the CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the attacker only needs network reachability to the EMS HTTP interface — no authentication, no special preparation, and no victim interaction are involved — and the resulting injection yields high confidentiality, integrity, and availability impact on the management database and, by extension, on the endpoints it controls. The vendor advisory FG-IR-25-1142 is the authoritative source for the affected endpoint, fixed version, and any additional technical indicators.
Frequently Asked Questions
Is CVE-2026-21643 being actively exploited?
Yes. CVE-2026-21643 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation, and public proof-of-concept code is available on GitHub. The EPSS score of 33.9% (96.97th percentile) further indicates that exploitation activity is widespread.
What products are affected by CVE-2026-21643?
CVE-2026-21643 affects Fortinet FortiClient EMS version 7.4.4. Administrators should consult Fortinet PSIRT advisory FG-IR-25-1142 for the complete list of affected builds and the corresponding fixed versions, and treat any internet-exposed EMS management interface as high risk.
How do I fix CVE-2026-21643?
Upgrade FortiClient EMS to the fixed version listed in Fortinet advisory FG-IR-25-1142, restrict access to the EMS HTTP interface to trusted administrative networks until the upgrade is verified, and review logs for indicators of SQL injection activity. Rotate EMS administrator and database credentials after remediation given the CRITICAL confidentiality impact.
How severe is CVE-2026-21643?
CVE-2026-21643 is rated CRITICAL with a CVSS 3.1 score of 9.8, the maximum for an unauthenticated, network-exploitable vulnerability with high confidentiality, integrity, and availability impact. Combined with an EPSS score in the 96.97th percentile and active KEV status, it should be treated as a top-priority patching target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.