Back Securityaffairs.Co

Critical Fortinet FortiClientEMS flaw allows remote code execution

Securityaffairs.Co •Pierluigi Paganini • February 9, 2026

Fortinet warns of a critical FortiClientEMS vulnerability that lets remote attackers run malicious code without logging in. Fortinet issued an urgent advisory to address a critical FortiClientEMS vulnerability, tracked as CVE-2026-21643 (CVSS score of 9.1). The vulnerability is an improper neutralization of special elements used in an SQL Command (‘SQL Injection’) issue in FortiClientEMS. An […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in Fortinet FortiClientEMS A critical SQL injection vulnerability, identified as CVE-2026-21643, has been discovered in Fortinet FortiClientEMS version 7.4.4. This flaw allows unauthenticated attackers to execute unauthorized code or commands, posing significant risks to affected systems. 21 sources 65

Extracted Entities

Critical Fortinet FortiClientEMS flaw allows remote code execution

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)