NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Fortinet FortiClient EMS SQL injection CVE-2026-21643 used in attacks; fix available

Attackers are exploiting a critical flaw in Fortinet FortiClient EMS 7.4.4, a business system for managing endpoint security. Ask IT to upgrade the EMS server to a current supported release; 7.4.5 first fixed this flaw.

What to do

If your workplace or family office uses FortiClient EMS, ask its IT provider to confirm the server has been upgraded from 7.4.4 to a current supported release; 7.4.5 first fixed this flaw. This requires an EMS server update by IT, rather than an update to the FortiClient app on your computer.

What’s happening

CVE-2026-21643 is a critical SQL injection flaw in the administrative web interface of Fortinet FortiClient EMS, which organisations use to manage FortiClient endpoint security software. Fortinet identifies version 7.4.4 as affected and recommends 7.4.5 or later. Someone able to reach the vulnerable interface can attack without logging in, potentially executing unauthorised code or commands. Fortinet disclosed the flaw on 6 February. Defused subsequently reported exploitation, covered by security publications on 30 March, and CISA listed it as exploited on 13 April. As at 3 November, the fix is available; the sources reviewed do not establish the number of compromised organisations or a final end to attacks.

What
Flaw
Affects
Fortinet FortiClient EMS
Affected
FortiClient EMS 7.4.4
Fixed in
FortiClient EMS 7.4.5 or later
CVE
CVE-2026-21643
Since
13 Apr 2026
Closed
13 Apr 2026

Timeline

  1. CISA added

    CISA added CVE-2026-21643 to its Known Exploited Vulnerabilities catalogue, confirming its use in attacks.

  2. Wider attacksFixed

    BleepingComputer reported that Defused had detected exploitation. A fix was available in FortiClient EMS 7.4.5 or later.

  3. Made public

    Fortinet published CVE-2026-21643, a critical SQL injection flaw affecting FortiClient EMS 7.4.4.

Sources

  1. Fortinet's published CVE-2026-21643 recordFortinet · 6 Feb 2026
  2. Critical Fortinet Forticlient EMS flaw now exploited in attacksBleepingComputer · 30 Mar 2026
  3. Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643)Help Net Security · 30 Mar 2026
  4. Fortinet security advisory (AV26-096) – Update 2Canadian Centre for Cyber Security · 13 Apr 2026
  5. CVE-2026-21643 DetailNIST · 6 Feb 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS