An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since April 13, 2026.

Exploitation active

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Fortinet
  • Forticlientems

Configuration 1 [-]

cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*

No data.

References
Link Providers
https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 cve-icon cve-icon
https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py cve-icon cve-icon
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643 cve-icon cve-icon
History

Wed, 15 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Title SQL Injection in FortiClientEMS Enables Unauthorized Code Execution

Tue, 14 Apr 2026 14:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*

Mon, 13 Apr 2026 18:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-04-13T00:00:00+00:00', 'dueDate': '2026-04-16T00:00:00+00:00'}

Mon, 30 Mar 2026 13:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 17 Feb 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*

Fri, 06 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 06 Feb 2026 08:30:00 +0000

Type Values Removed Values Added
Description An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
First Time appeared Fortinet
Fortinet forticlientems
Weaknesses CWE-89
CPEs cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet forticlientems
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'}
cve-icon MITRE

Status: PUBLISHED

Assigner: fortinet

Published: 2026-02-06T08:24:43.877Z

Updated: 2026-04-14T03:55:26.806Z

Reserved: 2026-01-02T08:41:26.514Z

Link: CVE-2026-21643

cve-icon Vulnrichment

Updated: 2026-02-06T14:53:24.618Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-06T09:15:49.330

Modified: 2026-04-14T14:21:18.670

Link: CVE-2026-21643

cve-icon Redhat

No data.