Critical SQL Injection in Fortinet FortiClient EMS (CVE‑2026‑21643) Under Active Exploitation Threatens Managed Endpoint Environments
What It Is – Fortinet FortiClient Endpoint Management Server (EMS) 7.4.4 contains a critical unauthenticated SQL‑injection (CVE‑2026‑21643) that lets an attacker send a crafted HTTP header to the web console and execute arbitrary SQL against the PostgreSQL backend.
Exploitability – Active exploitation has been observed in the wild within days of disclosure. No public proof‑of‑concept is required; the attack works with a single HTTP request. CVSS v3.1 is 9.8 (Critical).
Affected Products – FortiClient EMS 7.4.4 (multi‑tenant mode). Versions 7.2, 8.0 and single‑tenant deployments are not vulnerable.
TPRM Impact – Multi‑tenant deployments often host multiple customers on a single EMS instance. Compromise can expose admin credentials, endpoint inventories, security policies, and certificates, creating a supply‑chain foothold that cascades to downstream vendors and their users.
Recommended Actions –
- Upgrade all FortiClient EMS instances to version 7.4.5 immediately.
- If upgrade is not possible, disable internet exposure of the EMS admin interface and restrict access to trusted IP ranges.
- Review and harden multi‑tenant configurations; consider moving to single‑tenant mode where feasible.
- Deploy Web Application Firewall (WAF) rules to block malformed
Tenant-IDheaders. - Monitor EMS logs for anomalous header values and failed SQL queries.
Source: Help Net Security – Critical Fortinet FortiClient EMS bug under active attack (CVE‑2026‑21643)