Fortinet FortiClient EMS SQL Injection Vulnerability

FortinetFortiClient EMS

Status

Exploited in the wild
In CISA KEV since 13 Apr
Vendor fix available

Federal deadlineThu 16 Apr, 23:59 UTC

Passed 191 days ago

CISA KEV · added 13 Apr

Exploit probabilityEPSSchecked 25 Oct

98%probability of exploitation in the next 30 days

Higher than 100% of scored CVEs

SeverityCVSS

9.1Critical

Description NVD

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Coverage 12 articles · 7 outlets

See the full timeline

One row per outlet, in order of first report.

Show as table

CVE-2026-21643 coverage
Published (UTC)	Outlet	Headline
Mon 9 Feb · 04:35 UTC	SecurityOnline	Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCE
Mon 9 Feb · 21:55 UTC	Security Affairs	Critical Fortinet FortiClientEMS flaw allows remote code execution
Tue 10 Feb · 06:35 UTC	The Hacker News	Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution
Wed 11 Feb · 10:05 UTC	SecurityWeek	Fortinet Patches High-Severity Vulnerabilities
Mon 30 Mar · 11:09 UTC	Security Affairs	Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution
Tue 31 Mar · 11:50 UTC	SecurityWeek	Exploitation of Critical Fortinet FortiClient EMS Flaw Begins
Mon 6 Apr · 09:51 UTC	SecurityWeek	Fortinet Rushes Emergency Fixes for Exploited Zero-Day
Mon 6 Apr · 15:27 UTC	SOCRadar	Fortinet warns of critical CVE-2026-35616 flaw in FortiClient EMS
Mon 6 Apr · 21:11 UTC	Dark Reading	Fortinet issues fix for FortiClient EMS zero day CVE-2026-35616
Mon 13 Apr · 21:37 UTC	CISA	CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Mon 13 Apr · 22:05 UTC	CISA	CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV list
Tue 14 Apr · 06:31 UTC	The Hacker News	CISA adds six KEV flaws amid active Fortinet exploits

First in our coverage: SecurityOnline, 9 FebRSS feed

14 Apr 06:31CISA adds six KEV flaws amid active Fortinet exploitsThe Hacker News
13 Apr 22:05CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV listCISA · official notice
13 Apr 21:37CISA adds critical Fortinet FortiClient EMS SQLi flaw to KEV listCISA · official notice
6 Apr 21:11Fortinet issues fix for FortiClient EMS zero day CVE-2026-35616Dark Reading · mentions it in passing
6 Apr 15:27Fortinet warns of critical CVE-2026-35616 flaw in FortiClient EMSSOCRadar · mentions it in passing
6 Apr 09:51Fortinet Rushes Emergency Fixes for Exploited Zero-DaySecurityWeek · mentions it in passing
31 Mar 11:50Exploitation of Critical Fortinet FortiClient EMS Flaw BeginsSecurityWeek
30 Mar 11:09Critical Fortinet FortiClient EMS flaw exploited for Remote Code ExecutionSecurity Affairs
11 Feb 10:05Fortinet Patches High-Severity VulnerabilitiesSecurityWeek · mentions it in passing
10 Feb 06:35Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code ExecutionThe Hacker News
9 Feb 21:55Critical Fortinet FortiClientEMS flaw allows remote code executionSecurity Affairs
9 Feb 04:35Endpoint Exposed: Critical FortiClient EMS Flaw (CVSS 9.1) Allows Unauthenticated RCESecurityOnline · first in our coverage

References

NVD entrynvd.nist.gov CISA KEV cataloguecisa.gov Vendor advisoryfortiguard.fortinet.com CVE recordcve.org Weakness CWE-89cwe.mitre.org

Fortinet FortiClient EMS SQL Injection Vulnerability

Description NVD

CISA required action

Coverage 12 articles · 7 outlets

References

On this device

Intel

Settings

Keyboard shortcuts