SQL injection in Fortinet FortiClient EMS (CVE-2026-21643) — unauthenticated remote code execution; the endpoint-management server as target; CVSS 9.8
Fortinet FortiClient EMS, an endpoint-management server, contains a SQL injection flaw (CWE-89). Via specially crafted HTTP requests, an unauthenticated attacker may execute unauthorized code or commands. The CVSS published on NVD is 9.8 (CRITICAL). CISA added it to the KEV on 2026-04-13, due 2026-04-16 (3 days).
Key facts
- CVE IDCVE-2026-21643
- CVSS base score9.8 CRITICAL
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Affected (vendor / product)Fortinet FortiClient EMS
- CWECWE-89
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-04-16 (U.S. federal civilian agencies, BOD 22-01)
Key points
- SQL injection (CWE-89) in Fortinet FortiClient EMS — crafted HTTP requests may let an unauthenticated attacker execute unauthorized code/commands.
- The CVSS published on NVD is 9.8 (CRITICAL; AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) — unauthenticated, remote, no user interaction.
- The target is an endpoint-management server (EMS) — the command post centrally managing many endpoints' security.
- Seizing the defense's command post without authentication risks propagation across the managed fleet.
- CISA added it to the KEV on 2026-04-13, due 2026-04-16 (3 days). Fortinet products are KEV regulars.
SQL injection is a classic, dangerous flaw in which an attacker slips malicious SQL fragments into the process that builds a database query, making the database perform unintended operations. With insufficient input validation and sanitization, an attacker can bypass authentication, exfiltrate data, and sometimes execute commands on the server.
What makes this severe is that it is said to be possible on Fortinet FortiClient EMS without authentication (no login), as the vector's PR:N and UI:N confirm.
That the target is an "endpoint-management server (EMS)" matters. The EMS is the command post that centrally manages the security software (FortiClient) installed on many endpoints across an organization. Seizing that command post without authentication raises the concern of propagation across the managed endpoint fleet — the very heart of the defense becoming the entry point of attack.
Fortinet products, which handle boundary and management roles, are KEV regulars, and this joins them.
The CVSS published on NVD is 9.8 (CRITICAL), the highest tier, with unauthenticated, remote, no-user-interaction conditions all met. CISA setting a remediation window of just three days after the addition signals how pressing the exploitation risk is. The response is prompt updating per Fortinet's guidance.
Why it matters
An endpoint-management server is the heart of an organization's defense; allowing unauthenticated code execution raises the concern of propagation across the managed fleet. The CVSS published on NVD is 9.8 (CRITICAL), with unauthenticated, remote, no-user-interaction conditions met. CISA's 3-day deadline signals urgency; Fortinet operators should prioritize updating per Fortinet's guidance.
FAQ
What is SQL injection?
Why is targeting an endpoint-management server serious?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).