{"id":"fortinet-forticlient-ems-sql-injection-feb-2026","category":"patch","status":"closed","title":"Fortinet FortiClient EMS SQL injection CVE-2026-21643 used in attacks; fix available","tldr":"Attackers are exploiting a critical flaw in Fortinet FortiClient EMS 7.4.4, a business system for managing endpoint security. Ask IT to upgrade the EMS server to a current supported release; 7.4.5 first fixed this flaw.","summary":"CVE-2026-21643 is a critical SQL injection flaw in the administrative web interface of Fortinet FortiClient EMS, which organisations use to manage FortiClient endpoint security software. Fortinet identifies version 7.4.4 as affected and recommends 7.4.5 or later. Someone able to reach the vulnerable interface can attack without logging in, potentially executing unauthorised code or commands. Fortinet disclosed the flaw on 6 February. Defused subsequently reported exploitation, covered by security publications on 30 March, and CISA listed it as exploited on 13 April. As at 3 November, the fix is available; the sources reviewed do not establish the number of compromised organisations or a final end to attacks.","action":"If your workplace or family office uses FortiClient EMS, ask its IT provider to confirm the server has been upgraded from 7.4.4 to a current supported release; 7.4.5 first fixed this flaw. This requires an EMS server update by IT, rather than an update to the FortiClient app on your computer.","product":"Fortinet FortiClient EMS","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-21643"],"tags":["fortinet","forticlient-ems","sql-injection","actively-exploited"],"affected":["FortiClient EMS 7.4.4"],"fixed":["FortiClient EMS 7.4.5 or later"],"matches":[],"sources":[{"kind":"advisory","title":"Fortinet's published CVE-2026-21643 record","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21643.json","by":"Fortinet","date":"2026-02-06"},{"kind":"news","title":"Critical Fortinet Forticlient EMS flaw now exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/critical-fortinet-forticlient-ems-flaw-now-exploited-in-attacks/","by":"BleepingComputer","date":"2026-03-30"},{"kind":"news","title":"Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643)","url":"https://www.helpnetsecurity.com/2026/03/30/forticlient-ems-cve-2026-21643-reported-exploitation/","by":"Help Net Security","date":"2026-03-30"},{"kind":"advisory","title":"Fortinet security advisory (AV26-096) – Update 2","url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-096","by":"Canadian Centre for Cyber Security","date":"2026-04-13"},{"kind":"advisory","title":"CVE-2026-21643 Detail","url":"https://nvd.nist.gov/vuln/detail/cve-2026-21643","by":"NIST","date":"2026-02-06"}],"started":"2026-04-13","closed":"2026-04-13","created":"2026-11-03T22:26:16.103Z","updated":"2026-11-03T22:26:16.103Z","cve_notes":[{"cve":"CVE-2026-21643","name":"SQL injection in FortiClient EMS administrative interface","what":"A SQL injection flaw in FortiClient EMS 7.4.4's administrative web interface can let a remote attacker execute unauthorised code or commands without logging in.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-04-13","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2026-21643 to its Known Exploited Vulnerabilities catalogue, confirming its use in attacks.","url":"https://www.cyber.gc.ca/en/alerts-advisories/fortinet-security-advisory-av26-096","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-03-30","added":"2026-11-03T22:23:31.291Z","kind":"wider-attacks","text":"BleepingComputer reported that Defused had detected exploitation. A fix was available in FortiClient EMS 7.4.5 or later.","url":"https://www.bleepingcomputer.com/news/security/critical-fortinet-forticlient-ems-flaw-now-exploited-in-attacks/","by":"BleepingComputer","patch":"patched"},{"at":"2026-02-06","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Fortinet published CVE-2026-21643, a critical SQL injection flaw affecting FortiClient EMS 7.4.4.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/21xxx/CVE-2026-21643.json","by":"Fortinet","patch":null}],"url":"https://hard.fyi/live/fortinet-forticlient-ems-sql-injection-feb-2026/","json":"https://hard.fyi/api/live?id=fortinet-forticlient-ems-sql-injection-feb-2026"}