SQL injection vulnerability affecting Fortinet FortiClient EMS
The FortiClient EMS tool is affected by a vulnerability that would allow a malicious actor to manipulate certain SQL queries in order to inject malicious code.
Description
Technical context and vulnerability details
FortiClientEMS is a centralized management solution for FortiClient agents deployed on a company's endpoints. It allows you to configure security policies, deploy updates, and monitor client device compliance. This software is affected by a vulnerability labeled CVE-2026-21643, allowing an unauthenticated malicious actor to execute SQL commands by sending a GET request to the /api/v1/init_consts route. Exploitation of this flaw would allow a malicious actor to steal data, modify configurations, or execute commands on affected systems. This vulnerability is classified as critical with a severity score of 9.8 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Arbitrary code execution;
- Sensitive data leak;
- Database server compromise;
Affected systems
Products, components and targeted versions
- All FortiClient EMS versions between 7.4.0 and 7.4.4;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update FortiClient EMS to its latest available version;
Sources & External Links
Vendor security advisories and documentation
- https://fortiguard.fortinet.com/psirt/FG-IR-25-1142
- https://nvd.nist.gov/vuln/detail/CVE-2026-21643
- https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4
- https://ccb.belgium.be/advisories/warning-forticlient-ems-sql-injection-cve-2026-21643-patch-immediately
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.