FortiClient SQL Injection - Critical Vulnerability Exposed

The Flaw

Fortinet's FortiClient Endpoint Management Server (EMS) has a critical SQL injection vulnerability tracked as CVE-2026-21643. This flaw, with a CVSS score of 9.1, allows unauthenticated attackers to execute arbitrary SQL commands. Specifically, it affects FortiClient EMS version 7.4.4 when the multi-tenant mode is active. The vulnerability arises from a major middleware refactoring that improperly handles database connections.

The root issue lies in how the application processes the HTTP Site header. During the update to version 7.4.4, developers inadvertently introduced a flaw that allows attackers to inject SQL payloads. This vulnerability is particularly dangerous because it runs before any authentication checks, meaning attackers can exploit it without needing valid login credentials.

What's at Risk

Exploiting this vulnerability can lead to total compromise of the management database. Attackers can execute malicious SQL queries, potentially leading to remote code execution on the underlying host operating system. The implications are severe: hackers can steal administrator passwords, extract digital certificates, and modify security policies across an organization's network.

The /api/v1/init_consts endpoint is the most practical attack vector. It allows attackers to confirm if the multi-tenant flag is active and inject SQL payloads via the Site header. This endpoint lacks rate limiting and returns PostgreSQL error messages, which can be exploited for rapid data extraction.

Patch Status

Fortinet has addressed this critical issue in version 7.4.5. The patch replaces vulnerable code with parameterized identifier handling and securely escapes input. Organizations using FortiClient EMS 7.4.4 are urged to upgrade immediately to mitigate risks. For those unable to apply the patch, disabling the multi-tenant “Sites” feature can prevent exploitation.

Monitoring for indicators of compromise is essential. Administrators should look for unusually long response times on the affected endpoints and repeated HTTP 500 responses from a single IP address. Additionally, PostgreSQL error logs should be scrutinized for suspicious SQL statements.

Immediate Actions

Organizations must act swiftly to protect their systems. Here are the recommended steps:

• Upgrade to FortiClient EMS version 7.4.5 immediately.
• Disable the multi-tenant “Sites” feature if the upgrade cannot be applied right away.
• Restrict web access to the EMS management interface to trusted internal networks only.

By taking these actions, organizations can significantly reduce their exposure to this critical vulnerability and protect sensitive data from potential breaches.