Fortinet FortiClient EMS CVE-2026-21643 Actively Exploited

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

CVE-2026-21643

Fortinet

March 31, 2026

Executive Summary

An SQL injection flaw in FortiClient EMS is now under active exploitation. Unauthenticated attackers can run arbitrary code or commands on vulnerable hosts.

Key Details

Affected Platform

Fortinet FortiClient EMS

Attack Surface

Recommended Action

Apply vendor patch

Affected Environment

Fortinet FortiClient EMS 7.4 up to 7.4.4 is affected by CVE-2026-21643. Internet-exposed EMS instances, estimated in the low thousands, are at risk.

Operational Impact

Compromise may give attackers remote execution on EMS infrastructure. This can enable lateral movement, policy tampering, or broader access.

Technical Root Cause

Improper neutralization of SQL elements (CWE-89) in EMS request handling. Specifically crafted HTTP requests bypass input validation and reach SQL.

Recommended Mitigation

Upgrade FortiClient EMS from 7.4–7.4.4 to 7.4.5 or later after testing.
Implement structured vulnerability, patch, and privilege management.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Managed Detection and Response

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

Use vendor and community advisories to track exploit details and fixes. See BleepingComputer, GitHub PoC, and Fortinet PSIRT FG-IR-25-1142.