CVE-2026-21643Fortinet FortiClient EMS SQL Injection Vulnerability

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

9.1 CRITICALEPSS 97.73%⚡ Known Exploited (CISA KEV)NVD: Published

Last updated: 2026-11-06 15:42 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.1	CRITICAL	3.1fortinet (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Details

CVE ID: CVE-2026-21643
Status: Published
Assigner (CNA): fortinet
Published: Feb 6, 2026
Last modified: 2026-11-06 15:42 UTC
Weaknesses: CWE-89 · Execute unauthorized code or commands

Sources

NVD (unavailable at last refresh)
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-07 16:46 UTC.