A newly disclosed SQL injection vulnerability in Fortinet’s FortiClient EMS platform is now being actively exploited, according to threat intelligence firm Defused. Tracked as CVE-2026-21643, the flaw allows unauthenticated attackers to execute arbitrary code or commands via maliciously crafted HTTP requests targeting the EMS web interface.
What We Know
- Vulnerability: SQL injection in the
Siteheader of HTTP requests. - Affected version: FortiClient EMS 7.4.4.
- Patch available: Upgrade to 7.4.5 or later.
- Exposure: Shodan shows ~1,000 instances publicly accessible; Shadowserver tracks over 2,000 exposed EMS interfaces globally.
- Exploitation timeline: First observed four days ago, despite not yet being flagged on CISA’s Known Exploited Vulnerabilities list.
Why It Matters
Fortinet products are frequent targets in ransomware campaigns and state-sponsored espionage. Past FortiClient EMS flaws have been exploited by groups like Salt Typhoon to breach telecom providers. With over 1,400 exposed IPs in the U.S. and Europe, the risk of widespread compromise is high.
Defensive Actions
- Patch immediately: Upgrade to FortiClient EMS v7.4.5+.
- Restrict exposure: Remove EMS interfaces from public internet access.
- Monitor logs: Look for suspicious
Siteheader activity in HTTP requests. - Threat hunting: Check for signs of lateral movement, credential harvesting, or dropped implants (Sliver, TinyShell, etc.).
- Stay updated: Watch for Fortinet’s advisory update and CISA’s KEV list inclusion.
Broader Context
Fortinet has faced repeated exploitation cycles:
- CVE-2026-24858: FortiCloud SSO zero-day mitigated earlier this year.
- March 2024: CISA ordered patching of another EMS SQL injection flaw exploited in ransomware attacks.
- Overall: 24 Fortinet vulnerabilities flagged as actively exploited, 13 tied to ransomware.
Final Thought
The exploitation of CVE-2026-21643 reinforces a critical lesson: internet-exposed management interfaces are high-value targets. Organizations relying on Fortinet EMS must patch quickly, restrict exposure, and treat these systems as potential entry points for advanced adversaries.
Leave a Reply