CVE-2026-21643: FortiClientEMS SQL injection allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with full code execution impact, KEV listing, near-maximum EPSS, and a public exploit make this an urgent patch-first case.

What it is

FortiClientEMS 7.4.4 fails to neutralize special elements in SQL commands, exposing a SQL injection reachable through crafted HTTP requests. Because the flaw can be triggered without authentication and leads to unauthorized code or command execution, it is a critical pre-auth remote compromise risk for exposed management servers.

Impact

An unauthenticated attacker can execute unauthorized code or commands on the FortiClientEMS host, gaining full control of the server (CVSS 9.8, C/I/A all High).

Attack surface

Reached over the network via crafted HTTP requests to the FortiClientEMS service; the CVSS vector shows no privileges and no user interaction required, so any internet- or network-exposed instance is directly attackable.

Exploitation

CISA added it to KEV on 2026-04-13 with a 2026-04-16 remediation due date, EPSS 30-day probability is 0.94085 (99.8th percentile), and a public exploit script is referenced, indicating active exploitation.

What to do

• Apply the Fortinet vendor fix for FortiClientEMS per FG-IR-25-1142 immediately; if no fix is available for your build, follow vendor mitigations or discontinue use as CISA directs.
• Remove FortiClientEMS management interfaces from direct internet exposure and restrict access to trusted administrative networks.
• Treat any exposed instance as potentially compromised: rotate credentials and certificates, and review for unauthorized changes.
• Monitor Fortinet PSIRT and CISA KEV/BOD 22-01 guidance for updated remediation instructions and deadlines.

Detection

• Inspect HTTP request logs and WAF/IPS alerts for SQL injection patterns (UNION, stacked queries, comment sequences, tautologies) targeting FortiClientEMS endpoints.
• Hunt for unexpected child processes, web shells, or command execution spawned by the FortiClientEMS service account.
• Review database and application logs for anomalous queries or errors consistent with injected SQL.
• Alert on outbound connections or new files/accounts on FortiClientEMS hosts that deviate from baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.