{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21643", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-01-02T08:41:26.514Z", "datePublished": "2026-02-06T08:24:43.877Z", "dateUpdated": "2026-04-14T03:55:26.806Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiClientEMS", "cpes": ["cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "7.4.4", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-03-31T17:06:20.893Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to upcoming FortiClientEMS version 8.0.0 or above\nUpgrade to FortiClientEMS version 7.4.5 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1142", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1142"}]}, "adp": [{"references": [{"url": "https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py", "tags": ["exploit"]}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643", "tags": ["government-resource"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T00:00:00+00:00", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-21643"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2026-04-13", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T03:55:26.806Z"}, "timeline": [{"time": "2026-04-13T00:00:00.000Z", "lang": "en", "value": "CVE-2026-21643 added to CISA KEV"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21643", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-13T16:59:42.722917Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2026-04-13", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643"}}}], "references": [{"url": "https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py", "tags": ["exploit"]}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643", "tags": ["government-resource"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T14:53:24.618Z"}, "timeline": [{"lang": "en", "time": "2026-04-13T00:00:00.000Z", "value": "CVE-2026-21643 added to CISA KEV"}]}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiClientEMS", "versions": [{"status": "affected", "version": "7.4.4"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to upcoming FortiClientEMS version 8.0.0 or above\nUpgrade to FortiClientEMS version 7.4.5 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1142", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1142"}], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-03-31T17:06:20.893Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21643", "state": "PUBLISHED", "dateUpdated": "2026-04-14T03:55:26.806Z", "dateReserved": "2026-01-02T08:41:26.514Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-02-06T08:24:43.877Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"cisaActionDue": "2026-04-16", "cisaExploitAdd": "2026-04-13", "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Fortinet SQL Injection Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "552AF7AC-8630-442C-A7A4-66CA789DC3FD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL ('inyecci\u00f3n SQL') en Fortinet FortiClientEMS 7.4.4 podr\u00eda permitir a un atacante no autenticado ejecutar c\u00f3digo o comandos no autorizados a trav\u00e9s de solicitudes HTTP espec\u00edficamente dise\u00f1adas."}], "id": "CVE-2026-21643", "lastModified": "2026-04-14T14:21:18.670", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}]}, "published": "2026-02-06T09:15:49.330", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-1142"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit"], "url": "https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T15:15:31.938510+00:00", "value": {"mitigation_remediation": ["Upgrade FortiClientEMS to version 7.4.5 or higher, or to the 8.0.0 release as available.", "Restart the FortiClientEMS service after installing the update so the new code is loaded.", "Restrict unauthenticated HTTP traffic to FortiClientEMS by configuring firewall or network rules to allow only trusted IP addresses until the upgrade is complete."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via SQL Injection"}, "threat_synthesis": {"affected_systems": "The affected product is Fortinet FortiClientEMS, specifically version 7.4.4. Fortinet has advised upgrading to version 7.4.5 or higher, or the upcoming 8.0.0 release, to address the issue.", "description_and_impact": "An improper neutralization of special elements used in an SQL command permits SQL injection in FortiClientEMS 7.4.4. This flaw allows an unauthenticated attacker to supply crafted HTTP requests that result in execution of arbitrary SQL statements, thereby potentially enabling the attacker to execute unauthorized code or commands. The vulnerability can compromise confidentiality, integrity, and availability of the system.", "risk_and_exploitability": "The CVSS score of 9.1 indicates critical severity. An EPSS score of 34% indicates a high probability that the vulnerability will be exploited. The vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that it is actively targeted. Attackers can exploit the flaw remotely as an unauthenticated user by sending specially crafted HTTP requests to the FortiClientEMS service, potentially leading to remote code execution."}}}}, "created": "2026-04-15T17:45:10.849578+00:00", "title": "SQL Injection in FortiClientEMS Enables Unauthorized Code Execution", "updated": "2026-04-15T17:45:10.849591+00:00", "vendors": []}