CVE-2026-21643: Execute unauthorized code or commands in Fortinet FortiClientEMS
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
AI Analysis
Technical Summary
Fortinet FortiClientEMS 7.4.4 contains an improper neutralization of special elements in SQL commands (SQL injection) vulnerability. This flaw permits unauthenticated remote attackers to execute arbitrary code or commands via crafted HTTP requests, potentially compromising the affected system. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1, reflecting network attack vector, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. A patch addressing this vulnerability is available from Fortinet.
Potential Impact
Successful exploitation of this vulnerability can lead to full system compromise, including unauthorized code execution and command execution on the FortiClientEMS server. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A patch is available for Fortinet FortiClientEMS 7.4.4 to fix this SQL injection vulnerability. It is strongly recommended to apply the official update from Fortinet promptly. Since this is not a cloud service, remediation depends on applying the patch to the affected on-premises installations. Monitor Fortinet advisories for the patch release and installation instructions.
CVE-2026-21643: Execute unauthorized code or commands in Fortinet FortiClientEMS
Description
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
CVSS v3.1
Score 9.1critical
Affected software
pkg:github/fortinet/forticlientemsRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Fortinet FortiClientEMS 7.4.4 contains an improper neutralization of special elements in SQL commands (SQL injection) vulnerability. This flaw permits unauthenticated remote attackers to execute arbitrary code or commands via crafted HTTP requests, potentially compromising the affected system. The vulnerability is rated critical with a CVSS 3.1 base score of 9.1, reflecting network attack vector, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. A patch addressing this vulnerability is available from Fortinet.
Potential Impact
Successful exploitation of this vulnerability can lead to full system compromise, including unauthorized code execution and command execution on the FortiClientEMS server. This impacts confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported at this time.
Mitigation Recommendations
A patch is available for Fortinet FortiClientEMS 7.4.4 to fix this SQL injection vulnerability. It is strongly recommended to apply the official update from Fortinet promptly. Since this is not a cloud service, remediation depends on applying the patch to the affected on-premises installations. Monitor Fortinet advisories for the patch release and installation instructions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- fortinet
- Date Reserved
- 2026-01-02T08:41:26.514Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6985a694f9fa50a62fec94b1
Added to database: 02/06/2026, 08:30:12 UTC
Last enriched: 04/14/2026, 11:19:10 UTC
Last updated: 09/10/2026, 19:36:52 UTC
Views: 1540
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.