CVE-2026-21643

FortiClientEMS 7.4.4 SQL Injection Enabling Unauthenticated Remote Code Execution

View on CVE.org
Published Feb 6, 2026 CVSS 3.1 · 9.1 Critical EPSS 97.7% KEV · Listed
Description
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Analysis

AI-generated

Technical impact

An improper neutralization of special elements used in an SQL command permits SQL injection (CWE‑89) in FortiClientEMS 7.4.4. This flaw allows an unauthenticated attacker to supply crafted HTTP requests that result in execution of arbitrary SQL statements, thereby potentially enabling the attacker to execute unauthorized code or commands.

Affected Systems

The affected product is Fortinet FortiClientEMS, specifically version 7.4.4. Fortinet has advised upgrading to version 7.4.5 or higher, or the upcoming 8.0.0 release, to address the issue.

Risk and Exploitability

The CVSS score of 9.1 indicates critical severity. An EPSS score of 98% indicates a very high probability that the vulnerability will be exploited. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that it is actively targeted. Attackers can exploit the flaw remotely as an unauthenticated user by sending specially crafted HTTP requests to the FortiClientEMS service, potentially leading to remote code execution.

Remediation

Vendor Solution

Upgrade to FortiClientEMS version 8.0.0 or above Upgrade to FortiClientEMS version 7.4.5 or above

OpenCVE Recommended Actions

  • Upgrade FortiClientEMS to version 7.4.5 or higher, or to the 8.0.0 release as available.
  • Restart the FortiClientEMS service after installing the update so the new code is loaded.
  • Restrict unauthenticated HTTP traffic to FortiClientEMS by configuring firewall or network rules to allow only trusted IP addresses until the upgrade is complete.

Generated by OpenCVE AI on October 25, 2026 at 22:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title FortiClientEMS 7.4.4 SQL Injection Enabling Unauthenticated Remote Code Execution
Type Values Removed Values Added
Title Unauthenticated SQL Injection Leading to Remote Code Execution in FortiClientEMS
Type Values Removed Values Added
Title Unauthenticated SQL Injection Leading to Remote Code Execution in FortiClientEMS
Type Values Removed Values Added
Title Unauthenticated SQL Injection in FortiClientEMS 7.4.4
Type Values Removed Values Added
Title Unauthenticated SQL Injection in FortiClientEMS 7.4.4
Type Values Removed Values Added
Title SQL Injection in FortiClientEMS 7.4.4 Allowing Unauthenticated Code Execution
Type Values Removed Values Added
Title SQL Injection in FortiClientEMS 7.4.4 Allowing Unauthenticated Code Execution
Type Values Removed Values Added
Title SQL Injection Vulnerability in FortiClientEMS 7.4.4 Allows Unauthenticated Remote Code Execution
Type Values Removed Values Added
Title SQL Injection Vulnerability in FortiClientEMS 7.4.4 Allows Unauthenticated Remote Code Execution
Type Values Removed Values Added
Title SQL Injection in FortiClientEMS Enables Unauthorized Code Execution
Type Values Removed Values Added
Title SQL Injection in FortiClientEMS Enables Unauthorized Code Execution
Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-04-13T00:00:00+00:00', 'dueDate': '2026-04-16T00:00:00+00:00'}
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
CPEs cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
First Time appeared Fortinet
Fortinet forticlientems
Weaknesses CWE-89
CPEs cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*
Vendors & Products Fortinet
Fortinet forticlientems
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'}
Earlier changes (14)
Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Sources

Status
PUBLISHED
Assigner
fortinet
Published
Updated
Nov 6, 2026, 3:42 PM
Reserved
Jan 2, 2026, 8:41 AM

View source JSON

Updated
Feb 6, 2026, 2:53 PM

JSON

Status
Analyzed
Published
Feb 6, 2026, 9:15 AM
Modified
Jun 17, 2026, 10:18 AM

View source JSON

No data.

Updated
Oct 25, 2026, 10:45 PM

JSON