Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE

Fortinet has issued a high-priority advisory for FortiClient Enterprise Management Server (EMS) warning of a critical SQL injection vulnerability that could allow attackers to execute arbitrary code without logging in. Tracked as CVE-2026-21643, the flaw carries a CVSS score of 9.1 and could enable a remote attacker to take full control of the management server via specially crafted HTTP requests.

The vulnerability stems from improper sanitisation of user input in FortiClientEMS, enabling unauthenticated access to execute arbitrary code or commands. The issue affects FortiClientEMS 7.4, with version 7.4.4 listed as affected, while FortiClientEMS 8.0 and 7.2 are said to be not affected. Fortinet recommends upgrading FortiClientEMS 7.4.4 to 7.4.5 or above to close the security hole, as organisations running the affected version should verify their installations and apply the patch promptly.

The article, dated 9 February 2026, emphasises that this unauthenticated RCE vulnerability places endpoint management infrastructure at particular risk.

AI summary of the original article from SecurityOnline, written automatically by a language model. Quotes, figures and names come from that article; check it before relying on a detail. Read the original · How summaries are made

CVE-2026-21643 coverage
Published (UTC)	Outlet	Headline
Mon 9 Feb · 04:35 UTC	SecurityOnline	Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE (this article)
Mon 9 Feb · 21:55 UTC	Security Affairs	Critical Fortinet FortiClientEMS flaw allows remote code execution
Tue 10 Feb · 06:35 UTC	The Hacker News	Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution
Wed 11 Feb · 10:05 UTC	SecurityWeek	Fortinet Patches High-Severity Vulnerabilities
Mon 30 Mar · 11:09 UTC	Security Affairs	Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution
Tue 31 Mar · 11:50 UTC	SecurityWeek	Exploitation of Critical Fortinet FortiClient EMS Flaw Begins
Mon 6 Apr · 09:51 UTC	SecurityWeek	Fortinet Rushes Emergency Fixes for Exploited Zero-Day
Mon 6 Apr · 15:27 UTC	SOCRadar	Fortinet warns of critical CVE-2026-35616 flaw in FortiClient EMS
Mon 6 Apr · 21:11 UTC	Dark Reading	Fortinet issues fix for FortiClient EMS zero day CVE-2026-35616
Mon 13 Apr · 21:37 UTC	CISA	CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Mon 13 Apr · 22:05 UTC	CISA	CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Tue 14 Apr · 06:31 UTC	The Hacker News	CISA adds six KEV flaws amid active Fortinet exploits

CVE-2026-21643 coverage

Published (UTC)

Outlet

Headline

Mon 9 Feb · 04:35 UTC

SecurityOnline

Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE (this article)

Mon 9 Feb · 21:55 UTC

Security Affairs

Critical Fortinet FortiClientEMS flaw allows remote code execution

Tue 10 Feb · 06:35 UTC

The Hacker News