CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-04-13. EPSS: 93.9% chance of exploitation in the next 30 days.

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected products

• Fortinet FortiClient EMS: version 7.4.4 only

Published 2026-02-06. Last modified 2026-06-17.