CVE-2026-21643

What it actually does

This is a critical unauthenticated SQL injection vulnerability in Fortinet FortiClientEMS 7.4.4. Because attacker-controlled input in HTTP requests is not safely neutralized before being used in SQL commands, a remote attacker can manipulate backend database queries without credentials or user interaction. Given the stated impact, exploitation may allow database read/write access, authentication bypass or privilege changes, data modification, service disruption, and potentially operating-system command execution or unauthorized code execution through database or application execution paths.

Why it matters to the business

Successful exploitation can give an external attacker control over a FortiClient EMS deployment, including access to endpoint management data, policy configuration, user or device records, and potentially the underlying server. Operationally, this may disrupt endpoint management, weaken endpoint protection enforcement, expose sensitive enterprise asset information, and create a foothold for broader network compromise. The risk is urgent because the vulnerability has a CVSS score of 9.8, high EPSS probability, is listed in CISA KEV with a remediation due date of 2026-04-16, and is reported as actively exploited in the wild.

How an attack unfolds

An attacker first identifies an internet-accessible or reachable FortiClient EMS instance running the affected 7.4.4 version. They then send specially crafted HTTP requests containing SQL metacharacters or query fragments to a vulnerable EMS endpoint. If the input is concatenated into backend SQL statements, the attacker can alter query logic, extract data, modify records, or trigger database functionality beyond the intended application behavior. In higher-impact exploitation, the attacker may use SQL injection primitives to write malicious data, create or alter administrative state, access secrets, or invoke database features that lead to command execution on the EMS server. After gaining access or code execution, the attacker may deploy web shells or tooling, establish persistence, enumerate managed endpoints, tamper with security policies, and use the EMS server as a pivot point into the broader environment. Public reporting indicates active exploitation against this vulnerability class in Fortinet FortiClient EMS, so exposed systems should be treated as high priority for patching and compromise assessment.

How to fix it

Upgrade Fortinet FortiClientEMS to a vendor-supported version that fixes this vulnerability as soon as Fortinet publishes or provides the corrected release for the affected branch. Because no fixed version was provided in the input, administrators should consult the official Fortinet PSIRT advisory for CVE-2026-21643 and apply the exact recommended upgrade or hotfix for FortiClientEMS 7.4.4. Until patched, restrict EMS access to trusted administrative networks or VPNs only, block public internet exposure, apply WAF or reverse-proxy rules that detect SQL injection metacharacters where feasible, and monitor or rate-limit suspicious HTTP requests. If exploitation is suspected, isolate the EMS server, preserve forensic evidence, rotate credentials and API tokens associated with EMS, review administrative accounts and policies, and rebuild from a trusted source if unauthorized command execution or persistence is confirmed.

How to confirm the fix worked

Confirm the installed FortiClientEMS version is no longer 7.4.4 or otherwise matches the fixed release identified in the Fortinet advisory. Validate that FortiClient EMS management interfaces are not publicly reachable unless explicitly required and protected by strong access controls. Review vulnerability scanner results, software inventory, and Fortinet application version output to verify remediation. After patching, test that known-safe SQL injection probes are rejected or handled without SQL errors, authentication bypass, abnormal server responses, or backend database exceptions. Confirm EMS services are running normally, endpoint enrollment and policy distribution still function, and no unexpected administrative accounts, policy changes, scheduled tasks, web files, or child processes remain from possible pre-patch exploitation.

Typical attack path

1. Scan for Fortinet FortiClient EMS instances exposed to the internet or reachable from compromised networks.
2. Fingerprint the EMS version or infer exposure based on HTTP responses, page metadata, or behavior.
3. Send crafted HTTP requests containing SQL injection payloads to a vulnerable EMS endpoint.
4. Use SQL injection to enumerate database structure, extract sensitive data, or alter application state.
5. Attempt privilege escalation, administrative account manipulation, or session/token theft through database access.
6. If possible, leverage database or application behavior to execute operating-system commands on the EMS server.
7. Deploy persistence such as a web shell, scheduled task, service, or unauthorized account.
8. Use the compromised EMS server to inspect endpoint inventory, modify policies, stage tools, or pivot further into the network.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs, reverse-proxy or WAF logs, FortiClient EMS application logs, database audit/error logs, Windows Security logs, Sysmon/EDR telemetry, PowerShell logs, scheduled task logs, and file integrity monitoring for the EMS installation directories. Look for unauthenticated requests containing SQL metacharacters, UNION-based queries, time-delay functions, stacked queries, SQL comments, encoded payloads, database error messages, and repeated probing of EMS endpoints. Correlate suspicious HTTP requests with database errors, abnormal database queries, new or modified EMS administrator records, unusual session creation, policy changes, and unexpected child processes spawned by EMS, web server, database, or service processes. For potential command execution, hunt for cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, curl.exe, or rundll32.exe launched by FortiClient EMS-related services or web application processes. Also inspect for newly created web-accessible files, suspicious scripts, unauthorized scheduled tasks or services, unexpected outbound connections from the EMS server, and endpoint management policy changes near the time of suspicious requests. Where threat intelligence names exploitation activity against Fortinet FortiClient EMS SQL injection vulnerabilities, prioritize exposed systems and time windows after publication and during any observed EPSS increase or internet scanning activity.

• UNION SELECT
• UNION/**/SELECT
• INFORMATION_SCHEMA
• information_schema
• SLEEP(
• pg_sleep(
• WAITFOR DELAY
• BENCHMARK(
• LOAD_FILE(
• INTO OUTFILE
• xp_cmdshell
• OR 1=1
• ' OR '1'='1
• " OR "1"="1
• --
• /*
• */
• %27%20OR%20%271%27%3D%271
• %22%20OR%20%221%22%3D%221
• %55%4e%49%4f%4e%20%53%45%4c%45%43%54
• sqlmap
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• certutil.exe
• bitsadmin.exe
• rundll32.exe

What your security team should do

• Immediately identify all Fortinet FortiClientEMS deployments and prioritize any 7.4.4 instances for emergency remediation.
• Apply the Fortinet vendor fix or upgrade path as soon as available; treat the CISA KEV due date of 2026-04-16 as the latest acceptable remediation deadline, not the target date.
• Remove public internet exposure for EMS management interfaces and restrict access to trusted administrative networks or VPNs.
• Run a compromise assessment on affected EMS servers before and after patching, focusing on web logs, EMS application logs, database logs, Windows process creation events, scheduled tasks, new services, and suspicious files.
• Hunt for SQL injection payloads in HTTP requests, unexpected SQL errors, abnormal authentication events, and database activity inconsistent with normal EMS operation.
• Review EMS administrative users, roles, policies, endpoint groups, deployment packages, and server integrations for unauthorized changes.
• Rotate credentials, API keys, service account passwords, and integration secrets accessible to or stored by EMS if compromise cannot be ruled out.
• Increase monitoring for the FortiClient EMS server as a high-value management system, including EDR alerts for unusual child processes spawned by web or EMS services.
• If evidence of code execution or persistence is found, isolate the server and rebuild from known-good media rather than relying only on in-place cleanup.