CVE-2026-21643 - Vulnerability Details

Related Threat Clusters

• Iranian APT Group Conducts Password Spray Attacks on Microsoft 365 Accounts

  In March 2026, a suspected Iranian APT group, identified as Gray Sandstorm, initiated a password spraying campaign targeting Microsoft 365 accounts of over 300 organizations in Israel and more than 25 in the UAE. The…

  9 articles · Updated April 1, 2026
• Critical RCE Vulnerabilities Discovered in Fortinet Products

  Fortinet has identified multiple critical vulnerabilities in its FortiSandbox and FortiAuthenticator products, which could allow unauthenticated attackers to execute arbitrary code remotely. The vulnerabilities are…

  89 articles · Updated May 12, 2026
• Critical SQL Injection Vulnerability in Fortinet FortiClientEMS

  A critical SQL injection vulnerability, identified as CVE-2026-21643, has been discovered in Fortinet FortiClientEMS version 7.4.4. This flaw allows unauthenticated attackers to execute unauthorized code or commands,…

  21 articles · Updated February 9, 2026

Recent Intelligence Reports

• Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator — Bleepingcomputer · May 12, 2026
• Risky Bulletin: Iranian password sprays came first, then came the missiles — News.Risky.Biz · April 1, 2026
• CVE-2026-21643: Critical FortiClient EMS Vulnerability Enables Unauthenticated Remote ... — Socprime · February 10, 2026
• Fortinet Fixes Critical FortiClientEMS RCE (CVE-2026-21643, CVSS 9.1). SQL injection flaw ... — X · February 10, 2026
• Critical Fortinet FortiClient EMS Vulnerability Allows Remote Code Execution — Linkedin · February 10, 2026
• CVE-2026-21643: Critical SQL Injection in FortiClientEMS — Arcticwolf · February 9, 2026
• Critical Fortinet FortiClientEMS flaw allows remote code execution — Securityaffairs.Co · February 9, 2026
• Malicious code can slip through FortiClient EMS vulnerability — Heise.De · February 9, 2026

Related Entities