CVE-2026-21643

Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643)

CVSS 9.1 critical · Fortinet FortiClientEMS · published 2026-02-06

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

NVD · CVE.org

Coverage 1 source

1. 2026-03-30 Help Net Security critical Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643)

   Critical SQL injection vulnerability in Fortinet FortiClient EMS under active attack (CVE-2026-21643)

Also covered

• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 1 article · 2026-09-29
• CVE-2023-6548 Cloud Software Group NetScaler ADC CVSS 5.5 · 1 article · 2026-09-28
• CVE-2023-25608 Fortinet FortiAP-W2 CVSS 5.2 · 1 article · 2026-09-28
• CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVSS 9.5 · 3 articles · 2026-09-28
• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 3 articles · 2026-09-28