CVE-2026-21643

Fortinet FortiClientEMS code execution via SQL injection in endpoint server

critical · 9.1

Known exploited

Fix listed

Fortinet FortiClientEMS

Published Feb 6, 2026, 08:24 UTC

Description

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Reported fixed versions

7.4.5, 8.0.0

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.