Critical RCE in Fortinet FortiClient EMS (CVE‑2026‑21643) Enables Remote Code Execution
What It Is – Fortinet’s FortiClient Endpoint Management Server (EMS) contains a critical SQL‑injection flaw (CVE‑2026‑21643) that lets an unauthenticated attacker inject malicious SQL via the HTTP “Site” header and achieve remote code execution on the management server.
Exploitability – The vulnerability carries a CVSS 9.1 (Critical) score and is already being observed in the wild. Threat‑intel feeds (Defused, Shadowserver) report active exploitation within four days of public disclosure. No official KEV listing yet, but real‑world attacks are confirmed.
Affected Products – FortiClient EMS 7.4 through 7.4.4 (upgrade to 7.4.5 or later). Versions 8.0 and 7.2 are not affected.
TPRM Impact –
- Compromise of a third‑party endpoint‑management platform can give attackers footholds in multiple client networks, creating a supply‑chain risk.
- Successful exploitation may enable lateral movement, credential theft, or deployment of ransomware across downstream customers.
Recommended Actions –
- Immediately upgrade all FortiClient EMS deployments to version 7.4.5 or newer.
- Conduct an inventory of publicly exposed FortiClient EMS instances; block external access (e.g., restrict to internal IP ranges or VPN).
- Deploy Web Application Firewall (WAF) rules to sanitize the “Site” header and monitor for anomalous HTTP requests.
- Review logs for signs of SQL‑injection attempts and correlate with endpoint telemetry.
- Engage Fortinet support for any additional mitigations and confirm patch rollout across all managed sites.
Source: Security Affairs – Critical Fortinet FortiClient EMS flaw exploited for Remote Code Execution