SQL injection in Fortinet FortiClient EMS (CVE-2026-21643) — unauthenticated remote code execution; the endpoint-management server as target; CVSS 9.8

1What SQL injection is

SQL injection is a classic, dangerous flaw in which an attacker slips malicious SQL fragments into the process that builds a database query, making the database perform unintended operations. With insufficient input validation and sanitization, an attacker can bypass authentication, exfiltrate data, and sometimes execute commands on the server.

What makes this severe is that it is said to be possible on Fortinet FortiClient EMS without authentication (no login), as the vector's PR:N and UI:N confirm.

2An endpoint management server as the target

That the target is an "endpoint-management server (EMS)" matters. The EMS is the command post that centrally manages the security software (FortiClient) installed on many endpoints across an organization. Seizing that command post without authentication raises the concern of propagation across the managed endpoint fleet — the very heart of the defense becoming the entry point of attack.

Fortinet products, which handle boundary and management roles, are KEV regulars, and this joins them.

3A CVSS of 9.8, the top tier

The CVSS published on NVD is 9.8 (CRITICAL), the highest tier, with unauthenticated, remote, no-user-interaction conditions all met. CISA setting a remediation window of just three days after the addition signals how pressing the exploitation risk is. The response is prompt updating per Fortinet's guidance.

4How far input mixed into SQL can reach

SQL injection is a classic vulnerability, yet what it reaches on success depends on the target. Here the target is the control point for endpoint management.

1. 1Input mixes into the SQL being assembledIt enters the query without adequate validation or escaping
2. 2Unintended operations followAuthentication can be bypassed and data extracted
3. 3Commands run on the serverIn some cases it reaches arbitrary code execution
4. 4It propagates to the managed endpointsEMS centrally manages security software across many devices

EMS is the control point managing the security software deployed on many endpoints across an organisation. Taken unauthenticated, propagation to the managed fleet becomes the concern — the centre of the defence turned into the entrance for the attack. The CVSS published by NVD is 9.8 (CRITICAL), with unauthenticated, remote and no-user-interaction all present.