Black Friday60% off BLACKFRIDAY2026
Platform
PlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE

CVE-2026-21643

9.1
CVSScritical
Exploitable remotely over the internet · no authentication required.
Description

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
forticlientems
Updated Nov 10, 2026View on NVD →
S4E scanner
criticalWeb Vulnerabilities~10 seconds

Fortinet FortiClientEMS 7.4.4 - SQL Injection

Fortinet FortiClientEMS version 7.4.4 and earlier contains an unauthenticated SQL injection vulnerability in the /api/v1/init_consts endpoint. The 'Site' HTTP header value is passed directly into the PostgreSQL search_path without sanitization, allowing remote unauthenticated attackers to inject arbitrary SQL commands. This can lead to information disclosure, database manipulation, or OS command execution when chained with PostgreSQL functions. References: https://www.fortiguard.com/psirt/FG-IR-2026-21643 https://nvd.nist.gov/vuln/detail/CVE-2026-21643 Remediation: Upgrade FortiClientEMS to a patched version as recommended by Fortinet. As a workaround, restrict network access to the FortiClientEMS management interface and apply WAF rules to filter malicious Site header values.

9 assets checked · domain, subdomain, ipv4

CVE history: forticlientems

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →