Arcticwolf

Critical SQL Injection Vulnerability in Fortinet FortiClientEMS

First seen 10 Feb 2026, 04:55 UTC • Thehackernews

+14 •65.1

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A critical SQL injection vulnerability, identified as CVE-2026-21643, has been discovered in Fortinet FortiClientEMS version 7.4.4. This flaw allows unauthenticated attackers to execute unauthorized code or commands, posing significant risks to affected systems.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Timeline

2026-02-06

CVE-2026-21643 published

2026-02-06

First public PoC released

2026-02-07

Redhotcyber reports on vulnerability

2026-02-09

Arcticwolf reports on vulnerability

Attack Flow

15 entities, 38 inferred relationships (STIX 2.1).

Technique (5)

Remote Code Execution
Sql Injection
Zero-day Exploit
T1190 - Exploit Public-Facing Application
T1203 - Exploitation for Client Execution

Organization (1)

Fortinet

Vulnerability (4)

CVE-2026-21643
CVE-2026-24858
FortiClient EMS Vulnerability
Fortinet FortiClientEMS Remote Code Execution Vulnerability

Affected Platform (5)

FortiClient EMS
FortiClientEMS
FortiEMS Cloud
Fortinet FortiClientEMS
FortiOS

Relationships

CVE-2026-21643 targets FortiClient EMS
CVE-2026-21643 targets FortiClientEMS
CVE-2026-21643 targets FortiEMS Cloud
CVE-2026-21643 targets Fortinet FortiClientEMS
CVE-2026-24858 targets FortiClient EMS
CVE-2026-24858 targets FortiClientEMS
CVE-2026-24858 targets FortiEMS Cloud
CVE-2026-24858 targets Fortinet FortiClientEMS
FortiClient EMS Vulnerability targets FortiClient EMS
FortiClient EMS Vulnerability targets FortiClientEMS
FortiClient EMS Vulnerability targets FortiEMS Cloud
FortiClient EMS Vulnerability targets Fortinet FortiClientEMS
Fortinet FortiClientEMS Remote Code Execution Vulnerability targets FortiClient EMS
Fortinet FortiClientEMS Remote Code Execution Vulnerability targets FortiClientEMS
Fortinet FortiClientEMS Remote Code Execution Vulnerability targets FortiEMS Cloud
Fortinet FortiClientEMS Remote Code Execution Vulnerability targets Fortinet FortiClientEMS
Remote Code Execution targets FortiClient EMS
Remote Code Execution targets FortiClientEMS
Remote Code Execution targets FortiEMS Cloud
Remote Code Execution targets Fortinet FortiClientEMS
Sql Injection targets FortiClient EMS
Sql Injection targets FortiClientEMS
Sql Injection targets FortiEMS Cloud
Sql Injection targets Fortinet FortiClientEMS
Zero-day Exploit targets FortiClient EMS
Zero-day Exploit targets FortiClientEMS
Zero-day Exploit targets FortiEMS Cloud
Zero-day Exploit targets Fortinet FortiClientEMS
T1190 - Exploit Public-Facing Application targets FortiClient EMS
T1190 - Exploit Public-Facing Application targets FortiClientEMS
T1190 - Exploit Public-Facing Application targets FortiEMS Cloud
T1190 - Exploit Public-Facing Application targets Fortinet FortiClientEMS
T1203 - Exploitation for Client Execution targets FortiClient EMS
T1203 - Exploitation for Client Execution targets FortiClientEMS
T1203 - Exploitation for Client Execution targets FortiEMS Cloud
T1203 - Exploitation for Client Execution targets Fortinet FortiClientEMS
CVE-2026-21643 related to Fortinet
CVE-2026-21643 related to FortiOS

Continue Reading

Exploitation of FortiGate SSO Vulnerabilities by Threat Actors Critical Command Injection Vulnerability in Arista VeloCloud Orchestrator Under Active Exploitation GRU Compromises Home Routers in 23 States to Steal Outlook Credentials FortiWeb WAF Vulnerability Enables Full Admin Control Exploitation Critical Check Point VPN Vulnerability Exploited by Ransomware Gang Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials

Critical SQL Injection Vulnerability in Fortinet FortiClientEMS

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading