CVE-2026-21643: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an…

PriorityP198critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

KEVITWEXPLOITRansomware

CISA Known Exploited Vulnerabilitydue 2026-04-16

Exploited in the wild

EPSS

94.08%

99.8th percentile

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
fortinet	forticlientems	—	—
fortinet	forticlientems	—	—
fortinet	fortinet	—	—

Detection & IOCsextracted from sources · hover to see the quote

otherSite header (HTTP) used to smuggle SQL statements↗

→Monitor HTTP requests to FortiClient EMS web interface (GUI) for SQL injection payloads embedded in the 'Site' HTTP header. ↗
→Flag unauthenticated HTTP requests containing SQL syntax in non-standard headers targeting FortiClient EMS endpoints. ↗
→Identify internet-exposed FortiClient EMS instances (version 7.4.4) as high-priority targets; Shadowserver tracks over 2,000 exposed instances with 1,400+ IPs in the US and Europe. ↗

·Vulnerability affects only FortiClient EMS version 7.4.4; patched in version 7.4.5 or later. ↗
·Exploitation requires no authentication and is low-complexity, making any internet-exposed instance an immediate risk. ↗
·As of reporting, CVE-2026-21643 was not yet listed on CISA KEV despite confirmed in-the-wild exploitation observed 4 days prior. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ghsa8.8HIGH

vulncheck9.8CRITICAL

cisa9.8CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_SPECIFIC_APPS Fortigate Forticlient EMS HTTP Site Header SQL injection attempt (CVE-2026-21643)

suricata·2026-03-26·CVSS 9.8

CVE-2026-21643 [CRITICAL] ET WEB_SPECIFIC_APPS Fortigate Forticlient EMS HTTP Site Header SQL injection attempt (CVE-2026-21643) ET WEB_SPECIFIC_APPS Fortigate Forticlient EMS HTTP Site Header SQL injection attempt (CVE-2026-21643) Rule: alert http1 any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Fortigate Forticlient EMS HTTP Site Header SQL injection attempt (CVE-2026-21643)"; flow:established,to_server; http.uri; content:"/api/v1/"; startswith; fast_pattern; pcre:"/^(?:init_consts|auth\x2fsignin)$/R"; http.header; content:"Site|3a 20|"; pcre:"/^[^<]*?(?:'|%27|-{2}|%2d%2d)?(?:(?:S(?:HOW.+(?:C(?:UR(?:DAT|TIM)E|HARACTER.+SET)|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER|SLEEP|CONCAT|CASE))|U(?:NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)|S(?:HOW.+(?:C(?:HARACTER.+SET|UR(DATE|TIME))|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER))|U(?:NION.+SELEC|PDATE.+SE)T|(?:NULL(?:\x2c|%2[cC])){2,}|(?:\x2f|%2[fF])(?:\x2a|%2[aA]).+(?:\x2

Suricata

ET HUNTING Fortigate Forticlient EMS Multi-Tennant Fingerprinting Attempt

suricata·2026-03-26

CVE-2026-21643 ET HUNTING Fortigate Forticlient EMS Multi-Tennant Fingerprinting Attempt ET HUNTING Fortigate Forticlient EMS Multi-Tennant Fingerprinting Attempt Rule: alert http any any -> $HOME_NET any (msg:"ET HUNTING Fortigate Forticlient EMS Multi-Tennant Fingerprinting Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:19; content:"/api/v1/init_consts"; fast_pattern; reference:url,bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4; classtype:network-scan; sid:2068436; rev:1; metadata:affected_product FortiClient_EMS, attack_target Server, tls_state TLSDecrypt, created_at 2026_03_26, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Minor, updated_at 2026_03_26; target:dest_ip;)