Back www.fortiguard.com

FortiClient EMS insufficiently filters certain elements used in SQL commands

www.fortiguard.com • April 15, 2026

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an authenticated attacker to run arbitrary SQL queries on the database via sending crafted requests.

Fortinet remediated this issue in FortiClient Cloud and hence customers do not need to perform any action. Fortinet remediated this issue in FortiSASE and hence customers do not need to perform any action.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SQL Injection Vulnerabilities in FortiClient EMS and FortiDDoS-F Two SQL injection vulnerabilities have been identified in Fortinet products: FortiClient EMS and FortiDDoS-F. The vulnerability in FortiClient EMS allows authenticated attackers to execute arbitrary SQL queries on the database via crafted requests. Fortinet has remediated this issue in FortiClient Cloud and FortiSASE, requiring no action from customers. Similarly, the vulnerability in FortiDDoS-F also permits authenticated attackers to run arbitrary SQL queries through crafted HTTP requests. The affected versions of FortiDDoS-F are 7.2.1 and 7.2.2. Customers using these versions should be aware of the potential risks. No specific CVEs were mentioned for these vulnerabilities in the articles. The current status indicates that remediation has been implemented for FortiClient EMS, while FortiDDoS-F remains vulnerable without a patch mentioned. 52

FortiClient EMS insufficiently filters certain elements used in SQL commands

The full story

Extracted Entities

Attack Types (1)

Platforms (3)