Fortinet FortiClient EMS - Critical Flaw Allows Remote Code Execution
Basically, hackers can use a flaw in Fortinet software to run harmful code remotely.
A critical vulnerability in Fortinet's FortiClient EMS is being exploited, allowing remote code execution via SQL injection. Organizations must act quickly to protect their systems.
The Flaw
A serious vulnerability has been discovered in Fortinet's FortiClient EMS, identified as CVE-2026-21643. This flaw allows attackers to execute remote code through SQL injection, a method where malicious SQL statements are inserted into an entry field for execution. The vulnerability has a CVSS score of 9.1, indicating its critical nature. Attackers can exploit this flaw by sending specially crafted HTTP requests that include SQL commands in the 'Site' header.
The vulnerability was first reported by Gwendal Guégniaud from Fortinet's Product Security team. Despite being marked as not exploited on CISA’s Known Exploited Vulnerabilities list, researchers have detected active exploitation attempts. Reports indicate that nearly 1,000 instances of FortiClient EMS are publicly exposed, primarily in the U.S. and Europe, making them prime targets for attackers.
What's at Risk
If successfully exploited, this vulnerability can give attackers an initial foothold in the target network. This foothold can lead to lateral movement within the network, allowing attackers to deploy malware or further compromise sensitive systems. The potential for unauthorized access to critical systems poses a significant risk to organizations relying on FortiClient EMS for endpoint security.
Fortinet has categorized affected versions as follows:
- FortiClient EMS 8.0: Not affected
- FortiClient EMS 7.4: Upgrade to version 7.4.5 or above
- FortiClient EMS 7.2: Not affected
Organizations using vulnerable versions must take immediate action to mitigate risks.
Patch Status
In February 2026, Fortinet issued an urgent advisory regarding this vulnerability, highlighting the need for users to upgrade their systems. However, many users may still be unaware of the urgency due to the lack of visibility in major exploited vulnerability lists. The advisory emphasized that an unauthenticated attacker could exploit the flaw to execute unauthorized code, which underscores the necessity for prompt updates.
As of now, the recommended action for users of FortiClient EMS is to upgrade to the latest version to close this security gap. Failure to do so could leave organizations vulnerable to ongoing exploitation attempts.
Immediate Actions
Organizations should prioritize the following actions:
- Upgrade FortiClient EMS to the latest version as soon as possible.
- Monitor network traffic for unusual activity that may indicate exploitation attempts.
- Educate staff about the risks associated with SQL injection attacks and the importance of software updates.
By taking these steps, organizations can significantly reduce their risk of falling victim to attacks leveraging this critical vulnerability. The cybersecurity landscape is ever-evolving, and staying informed is key to maintaining robust defenses.