Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution

Fortinet has released security updates to address a critical flaw in FortiClientEMS that could allow unauthenticated code execution. The vulnerability is tracked as CVE-2026-21643 and carries a CVSS score of 9.1/10. According to Fortinet, it involves improper neutralisation of SQL elements in FortiClientEMS that could enable an unauthenticated attacker to execute arbitrary code via specially crafted HTTP requests.

The affected FortiClientEMS versions are 7.4.4 (upgradable to 7.4.5 or above) and 8.0 (not affected by this issue), while FortiClientEMS 7.2 is listed as not affected. Gwendal Guégniaud of the Fortinet Product Security team is credited with discovering and reporting the flaw. The development comes after Fortinet previously addressed another critical FortiOS-related issue, CVE-2026-24858, which Fortinet notes has been exploited in the wild to compromise devices and alter configurations.

AI summary of the original article from The Hacker News, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made

CVE-2026-21643 coverage
Published (UTC)	Outlet	Headline
Mon 9 Feb · 04:35 UTC	SecurityOnline	Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE
Mon 9 Feb · 21:55 UTC	Security Affairs	Critical Fortinet FortiClientEMS flaw allows remote code execution
Tue 10 Feb · 06:35 UTC	The Hacker News	Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution (this article)
Wed 11 Feb · 10:05 UTC	SecurityWeek	Fortinet Patches High-Severity Vulnerabilities
Mon 30 Mar · 11:09 UTC	Security Affairs	Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution
Tue 31 Mar · 11:50 UTC	SecurityWeek	Exploitation of Critical Fortinet FortiClient EMS Flaw Begins
Mon 6 Apr · 09:51 UTC	SecurityWeek	Fortinet Rushes Emergency Fixes for Exploited Zero-Day
Mon 6 Apr · 15:27 UTC	SOCRadar	Fortinet warns of critical CVE-2026-35616 flaw in FortiClient EMS
Mon 6 Apr · 21:11 UTC	Dark Reading	Fortinet issues fix for FortiClient EMS zero day CVE-2026-35616
Mon 13 Apr · 21:37 UTC	CISA	CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Mon 13 Apr · 22:05 UTC	CISA	CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Tue 14 Apr · 06:31 UTC	The Hacker News	CISA adds six KEV flaws amid active Fortinet exploits

CVE-2026-21643 coverage

Published (UTC)

Outlet

Headline

Mon 9 Feb · 04:35 UTC

SecurityOnline

Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE

Mon 9 Feb · 21:55 UTC

Security Affairs

Critical Fortinet FortiClientEMS flaw allows remote code execution

Tue 10 Feb · 06:35 UTC

The Hacker News