CVE-2026-21643Active Exploitation(fortinet / forticlientems)

CRITICALCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 30 mentions and remains active

Immediate actions

Patch fortinet forticlientems systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

fortinet CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-04-16. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exploit / PoC references

https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py

Vendor / third-party advisories

https://fortiguard.fortinet.com/psirt/FG-IR-25-1142

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643

Weakness type (CWE)

CWE-89

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

forticlientems

Threat summary

Active exploitation appears in 124 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
233 mentions across 51 observed days

What's happening

Active exploitation reported across 124 signals
Exploit tool or code specified in 5 signals
PoC mentioned or linked in 28 signals
Patch or workaround mentioned in 99 signals
Technical details provided in 184 signals
Disclosure: 42 classified signals
Peaked 32d ago at 30 mentions (2026-03-30); latest day: 2
233 total mentions across 51 days

Affected systems

Vendors

fortinet

Products

forticlientems

1 version affected across 1 product

Deep dive

Activity timeline233 mentions / 51d

Signal classification6 categories

Active Exploitation

11951.5%

Patch

4720.3%

Disclosure

4218.2%

General

166.9%

PoC

62.6%

Exploit

10.4%

Referenced assets164 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-06	8	Disclosure8
2026-02-09	4	Exploit1General1Patch2
2026-02-10	24	Disclosure5General2Patch17
2026-02-11	10	Disclosure2General1Patch7
2026-02-14	1	Disclosure1
2026-02-16	1	Disclosure1
2026-02-19	1	Patch1
2026-02-23	1	Patch1
2026-02-25	1	Patch1
2026-03-10	2	Active Exploitation1Disclosure1
2026-03-11	1	Disclosure1
2026-03-13	1	PoC1
2026-03-14	1	General1
2026-03-17	3	Disclosure3
2026-03-18	3	Disclosure1Patch1PoC1
2026-03-19	1	Active Exploitation1
2026-03-26	1	Disclosure1
2026-03-28	2	Active Exploitation1Disclosure1
2026-03-30	30	Active Exploitation23General4Patch2PoC1
2026-03-31	20	Active Exploitation16Disclosure2General1PoC1
2026-04-01	15	Active Exploitation12Disclosure2Patch1
2026-04-03	4	Active Exploitation4
2026-04-04	5	Active Exploitation4Patch1
2026-04-05	9	Active Exploitation4Disclosure2General2Patch1
2026-04-06	15	Active Exploitation15
2026-04-07	10	Active Exploitation8General1Patch1
2026-04-09	2	Active Exploitation1Disclosure1
2026-04-10	2	Active Exploitation2
2026-04-12	1	Disclosure1
2026-04-13	5	Active Exploitation3Disclosure2
2026-04-14	5	Active Exploitation5
2026-04-15	3	Active Exploitation2General1
2026-04-16	7	Active Exploitation1Disclosure3General1Patch1PoC1
2026-04-17	4	Active Exploitation2Patch2
2026-04-18	2	Patch2
2026-04-19	3	Active Exploitation2Patch1
2026-04-20	2	Active Exploitation2
2026-04-21	2	Active Exploitation2
2026-04-23	1	Disclosure1
2026-04-24	3	Active Exploitation1Disclosure1Patch1
2026-04-27	3	Active Exploitation2Patch1
2026-05-01	1	Disclosure1
2026-05-04	1	PoC1
2026-05-08	2	Active Exploitation2
2026-05-12	1	Patch1
2026-05-19	1	Active Exploitation1
2026-05-21	2	Disclosure1General1
2026-06-16	2	Active Exploitation1Patch1
2026-06-17	1	Active Exploitation1
2026-08-11	1	Patch1

Full discourse20 posts

Hunter@HunterMapping192d
Active Exploitation
🚨Alert🚨 CVE-2026-21643 (CVSS 9.1) : Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 🧐Detail : https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4 📊 4K+ Services are found on the http://hunter.how yearly. 🔗Hunter Link:https://hunter.how/list?searchValue=product.name%3D%22FortiClient%20Endpoint%20Management%20Server%22 👇Query HUNTER : http://product.name="FortiClient Endpoint Management Server" 📰Refer:https://www.bleepingcomputer.com/news/security/critical-fortinet-forticlient-ems-flaw-now-exploited-in-attacks/ https://fortiguard.fortinet.com/psirt/FG-IR-25-1142 #hunterhow #infosec #infosecurity #OSINT #Vulnerability
Post summary
CVE-2026-21643 is a high‑severity pre‑authentication SQL injection in FortiClient EMS 7.4.4 that is currently being exploited in the wild, with vendor advisory and patch information available.
579133419420.4K
25.9K followersView on X
Anastasis Vasileiadis@Anastasis_King189d
Active Exploitation
🚨 Bug Bounty / Red Team Tip CVE-2026-21643 — Critical Pre-Auth SQL Injection (CVSS 9.1) in FortiClient EMS 7.4.4 (multi-tenant mode only) Unauthenticated attackers can inject arbitrary SQL via the Site HTTP header to the public endpoint /api/v1/init_consts (or login endpoint). This happens before authentication and hits the PostgreSQL backend with superuser-level access in many setups → full DB dump, schema extraction, or RCE (via PostgreSQL features like COPY FROM PROGRAM). - Affected: Only FortiClient EMS 7.4.4 (multi-tenant/Sites feature enabled) - Not affected: 7.2.x, 8.0.x, single-site deployments - Fixed: Upgrade to 7.4.5 or later - Status: Actively exploited in the wild + public PoCs available Main Detail Article (Highly Recommended): Bishop Fox deep-dive with exploitation paths, payloads (e.g., pg_sleep(5) for blind testing), and lab results → https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4 Public PoC (GitHub): https://github.com/0xBlackash/CVE-2026-21643 Useful Google/Shodan Dorks: - http.title:"FortiClient EMS" "7.4.4" - http.html:"FortiClient Enterprise Management Server" - http.favicon.hash: -specific-hash (or search for EMS login page) - Shodan: "Model: FCTEMS" or "FortiClient EMS" Quick Check: If your EMS login page is internet-facing and running 7.4.4 with multi-tenant enabled → patch ASAP or block public access. Thousands of instances are exposed (Shadowserver ~2k+, Shodan ~1k+). High-value target for hunters. Patch or restrict immediately! #BugBounty #RedTeam #Fortinet #CVE202621643 #SQLi
Post summary
CVE-2026-21643 is a critical pre-auth SQL injection in FortiClient EMS 7.4.4, actively exploited in the wild with publicly available PoC code; upgrade to 7.4.5 or block internet-facing access immediately.
257125813616.1K
10.2K followersView on X
NullSecurityX@NullSecurityX177d
Disclosure
CVE-2026-21643 "FortiGhost" : Pre-Auth SQLi RCE in FortiClientEMS Useful Google/Shodan Dorks: - http.title:"FortiClient EMS" "7.4.4" - http.html:"FortiClient Enterprise Management Server" - http.favicon.hash: -specific-hash (or search for EMS login page) https://t.co/0N4zEqRNNX
Post summary
The post discloses CVE-2026-21643 as a pre‑authentication SQL injection that can lead to remote code execution in FortiClient EMS, and offers search queries to identify affected installations.
150124812417.0K
12.1K followersView on X
The Hacker News@TheHackersNews242d
Patch
🚨🛡️ Fortinet Fixes Critical FortiClientEMS RCE (CVE-2026-21643, CVSS 9.1). SQL injection flaw enables unauthenticated remote command execution via crafted requests. Affects EMS 7.4.4 (patch available). 🔗 See affected versions and patch guidance → https://thehackernews.com/2026/02/fortinet-patches-critical-sqli-flaw.html
Post summary
Fortinet released a patch for CVE‑2026‑21643, a critical SQL injection flaw in FortiClientEMS that could lead to unauthenticated remote command execution on version 7.4.4, with patch guidance provided via the linked article.
55531422138.6K
1.0M followersView on X
Defused@DefusedCyber196d
Active Exploitation
🚨 Fortinet Forticlient EMS CVE-2026-21643 - currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists - has seen first exploitation already 4 days ago according to our data Attackers can smuggle SQL statements through the "Site"-header inside an HTTP request According to Shodan, close to 1000 instances of Forticlient EMS are publicly exposed. Track exploitation of this and other Fortinet honeypots 👉 https://console.defusedcyber.com/capabilities
Post summary
CVE‑2026‑21643 in Fortinet Forticlient EMS has been actively exploited, with attackers injecting SQL via the Site header; no patch or PoC details are provided.
1304685441.8K
6.7K followersView on X
Rishi@rxerium194d
Active Exploitation
🚨 CVE-2026-21643 an SQL Injection vulnerability (CVSS 9.8) is seeing active exploitation in the wild as reported by @DefusedCyber Vulnerability detection script available here: https://github.com/rxerium/rxerium-templates/blob/main/2026/CVE-2026-21643.yaml This vulnerability currently only affects FortiClientEMS 7.4.4 and it is recommended that you upgrade to 7.4.5 or later as reported by Fortinet: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142
Post summary
CVE-2026-21643 is a high‑severity SQL injection affecting FortiClientEMS 7.4.4 that is actively exploited in the wild; users should upgrade to 7.4.5 or later or apply vendor patches.
1161783613.0K
3.8K followersView on X
Cyber Security News@The_Cyber_News194d
Active Exploitation
⚠️ Critical Fortinet FortiClient EMS Vulnerability Exploited in Attacks Source: https://cybersecuritynews.com/forticlient-ems-vulnerability-exploited/ A critical SQL injection vulnerability in Fortinet’s FortiClient Endpoint Management Server (EMS), tracked as CVE-2026-21643, is actively being exploited in the wild. In observed attacks, threat actors are bypassing security controls by smuggling malicious SQL statements through the Site header within an HTTP GET request. A recorded payload targeting the /api/v1/init_consts endpoint demonstrates attackers injecting commands such as Site: x'; SELECT pg_sleep(4)--. This specific attack was observed originating from the threat actor IP address 104.192.92[.]135. #cybersecuritynews #vulnerability
Post summary
CVE-2026-21643 is a critical SQL injection flaw in Fortinet FortiClient EMS that is being actively exploited in the wild, as attackers inject SQL through the Site header, but the post lacks any PoC, exploitation code, or patch information.
318066144.4K
65.9K followersView on X
Cristian Borghello@SeguInfo177d
General
Como diría alguien (de #Fortinet): "que MAL que la estoy pasando"😤 - CVE-2026-21643 - Inyección SQL (9.1) - CVE-2026-35616 - Control de acceso inadecuado (9.1) - CVE-2026-39808 - Ejecución de comandos (9.1) 🔗https://blog.segu-info.com.ar/2026/04/otra-vulnerabilidad-critica-rce-en.html PARCHEA!
Post summary
The blog post lists three critical CVEs with corresponding vulnerability types but offers no concrete exploitation, mitigation, or patch details.
012038152.9K
38.3K followersView on X
The Shadowserver Foundation@Shadowserver188d
Active Exploitation
Heads up FortiClient EMS users! CVE-2026-35616 (new) & CVE-2026-21643 - both unauthenticated RCE observed to be exploited in the wild! We fingerprint about 2000 instances globally, see public Dashboard: https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=30&vendor=fortinet&model=forticlient+enterprise+management+server+%28ems%29&dataset=count&limit=100&group_by=geo&stacking=stacked&auto_update=on Top affected: US & Germany https://dashboard.shadowserver.org/statistics/iot-devices/map/?date_range=1&vendor=fortinet&model=forticlient+enterprise+management+server+%28ems%29&data_set=count&scale=log&auto_update=on https://t.co/tLOs6mhgBk
Post summary
FortiClient EMS users are warned that CVE-2026-35616 and CVE-2026-21643—unauthenticated remote code execution flaws—are being actively exploited worldwide, with over 2,000 instances detected, mainly in the US and Germany.
114133158.5K
21.8K followersView on X
FOFA@fofabot192d
Disclosure
⚠️⚠️ CVE-2026-21643 (CVSS 9.8): Pre-auth SQL injection in FortiClient EMS 7.4.4 may allow unauthorized code or command execution via crafted HTTP requests. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJGb3J0aUNsaWVudC1FTVMi 🎯2.8K+ Results are found on http://en.fofa.info. FOFA Query: app="FortiClient-EMS" 🔖Refer: https://nvd.nist.gov/vuln/detail/CVE-2026-21643 #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
CVE‑2026‑21643 is a high‑severity pre‑authentication SQL injection in FortiClient EMS 7.4.4, potentially allowing remote code execution via crafted HTTP requests; the post references FOFA search results and the NVD entry.
14036152.5K
14.3K followersView on X
Defused@DefusedCyber205d
Active Exploitation
🚨 Two updates from the Defused honeypot lab 1️⃣ New FortiClient EMS decoy deployed CVE-2026-21643 (pre-auth SQLi, CVSS 9.1) - Bishop Fox just dropped a full exploitation writeup for FortiClient EMS 7.4.4. No public exploitation observed yet but with a detailed writeup now out, it's a matter of time. We've added a FortiClient EMS honeypot stream to catch early exploitation attempts 🍯 2️⃣ SharePoint CVE-2026-20963 added to CISA KEV Microsoft SharePoint deserialization flaw - actively exploited in the wild. RCE via crafted network requests, no auth required. Track exploitation attempts against our SharePoint decoys on the platform. 👉 http://console.defusedcyber.com/signup
Post summary
The update announces a full exploitation writeup for a FortiClient EMS SQLi vulnerability and confirms that the SharePoint deserialization flaw is being actively exploited in the wild.
1922664.1K
6.2K followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi178d
Active Exploitation
6 ثغرات تهدد اغلب الاجهزة والشبكات يتم استغلالها حاليا 🚨 CISA أضافت 6 ثغرات جديدة لقائمة (KEV)Known Exploited Vulnerabilities بعد تأكد الاستغلال الفعلي لها حاليا من قبل المخترقين. الثغرة CVE-2026-21643 (CVSS: 9.1) 🔴 المنتج: FortiClient EMS من Fortinet النوع: SQL Injection التأثير: تنفيذ كود خبيث بدون مصادقة الحالة: استغلال مؤكد منذ 24 مارس 2026 الثغرة CVE-2020-9715 (CVSS: 7.8)🟠 المنتج: Adobe Acrobat Reader النوع: Use-After-Free التأثير: Remote Code Execution ثغرة تستغل من (2020) ولكن تم اكتشافها والاعلان عنها مؤخرا الثغرة CVE-2023-36424 (CVSS: 7.8) 🟠 المنتج: Microsoft Windows Common Log File System Driver النوع: Out-of-Bounds Read التأثير: Privilege Escalation ما فيه تقارير استغلال علنية، بس CISA تؤكد انها تتسغل حاليا . الثغرة CVE-2023-21529 (CVSS: 8.8) 🔴 المنتج: Microsoft Exchange Server النوع: Deserialization of Untrusted Data التأثير: Remote Code Execution المجموعة الصينية Storm-1175 تستغلها لـ Medusa Ransomware. الثغرة CVE-2025-60710 (CVSS: 7.8)🟠 المنتج: Host Process for Windows Tasks النوع: Improper Link Resolution Before File Access التأثير: Local Privilege Escalation الثغرة CVE-2012-1854 (CVSS: 7.8) 📅🟠 المنتج: Microsoft Visual Basic for Applications (VBA) النوع: Insecure Library Loading التأثير: Remote Code Execution ثغرة من 2012! Microsoft عمرها ١٤ سنه ولاتزال تستغل
Post summary
The post announces that six CVEs are being actively exploited, as confirmed by CISA’s KEV list, and provides detailed technical information for each vulnerability without offering patches or code.
16020152.6K
49.2K followersView on X
elhacker.NET@elhackernet189d
Active Exploitation
[Blog] Explotación activa de una inyección SQL crítica en Fortinet FortiClient EMS (CVE-2026-21643) https://blog.elhacker.net/2026/04/explotacion-activa-de-una-inyeccion-sql.html
Post summary
CVE-2026-21643, a critical SQL injection in Fortinet FortiClient EMS, is being actively exploited in the wild as indicated by the blog title.
01102832.3K
140.8K followersView on X
Cristian Borghello@SeguInfo193d
Active Exploitation
(Otra) Vulnerabilidad SQLi está siendo explotada en Fortinet FortiClient EMS (CVE-2026-21643) http://blog.segu-info.com.ar/2026/03/otra-vulnerabilidad-sqli-esta-siendo.html
Post summary
The post reports that the SQL injection flaw CVE-2026-21643 in Fortinet FortiClient EMS is actively being exploited, but provides no PoC, exploit code, patch, or false-positive information.
0802762.3K
38.3K followersView on X
Dark Web Informer@DarkWebInformer194d
General
‼️ CVE-2026-21643 detection script for FortiClientEMS 7.4.4. 👇
Post summary
The post cites a detection script for CVE-2026-21643 on FortiClientEMS 7.4.4 but offers no additional exploit, mitigation, or technical details.
1701867.1K
218.4K followersView on X
siri@fu4k1@sirifu4k1211d
PoC
Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 - CVE-2026-21643 #cve #poc #sqli https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4
Post summary
The message announces a pre‑authentication SQL injection (CVE‑2026‑21643) in FortiClient EMS 7.4.4, shares a link hinting at a proof‑of‑concept, and provides basic technical details.
11001451.3K
6.9K followersView on X
watchTowr@watchtowrcyber177d
Disclosure
Rapid reaction gets you ahead. 67 days before CISA added CVE-2026-21643 (Fortinet FortiClientEMS SQL Injection) to KEV, watchTowr clients were aware of their exposure. Reach out via our website if you need support. https://t.co/wUcr9152hJ
Post summary
watchTowr warned its clients about CVE‑2026‑21643 67 days before CISA listed it on KEV, providing early exposure awareness without offering a PoC, exploit code, or patch details.
1201762.8K
12.1K followersView on X
Gray Hats@the_yellow_fall207d
Disclosure
Bishop Fox publicly disclosed details of a critical 9.1 CVSS zero-click SQL injection in FortiClient EMS (CVE-2026-21643). Patch to 7.4.5 immediately. #FortiClient #CVE #SQLInjection #CyberSecurity #InfoSec #BishopFox #ZeroClick #Vulnerability #TechNews https://securityonline.info/publicly-disclosed-critical-zero-click-sql-injection-forticlient-ems-cve-2026-21643/ https://t.co/ik3TZ9xhPd
Post summary
Bishop Fox disclosed a zero‑click SQL injection (CVE‑2026‑21643) in FortiClient EMS with a CVSS score of 9.1 and urged users to patch to version 7.4.5 immediately.
0701421.1K
10.7K followersView on X
elhacker.NET@elhackernet190d
Active Exploitation
[Blog] Vulnerabilidad SQLi está siendo explotada en Fortinet FortiClient EMS (CVE-2026-21643) https://blog.elhacker.net/2026/04/vulnerabilidad-sqli-esta-siendo.html
Post summary
The blog post announces that CVE-2026-21643, a SQL injection vulnerability in Fortinet FortiClient EMS, is currently being exploited.
1601211.8K
140.8K followersView on X
IT-Connect.fr@ITConnect_fr192d
Active Exploitation
🛑 Fortinet 👉 CVE-2026-21643 : cette faille de sécurité critique présente dans FortiClient EMS commence à être exploitée par les cybercriminels. Le point à ce sujet 👇 - https://www.it-connect.fr/cve-2026-21643-cette-faille-critique-dans-forticlient-ems-est-exploitee/ #infosec #cybersecurite #fortinet https://t.co/jLNNq1vhbf
Post summary
The tweet claims CVE-2026-21643 is being actively exploited against FortiClient EMS, but provides no concrete evidence, PoC, or technical details.
04091587
11.4K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	fortinet	forticlientems	7.4.4	-	-

Explore more

Back to dashboard fortinet CVEs forticlientems vulnerabilities

What researchers are saying

CVE-2026-21643

Hunter[verified]@HunterMappingActive Exploitation

CVE-2026-21643 is a high‑severity pre‑authentication SQL injection in FortiClient EMS 7.4.4 that is currently being exploited in the wild, with vendor advisory and patch information available.

Anastasis Vasileiadis[verified]@Anastasis_KingActive Exploitation

CVE-2026-21643 is a critical pre-auth SQL injection in FortiClient EMS 7.4.4, actively exploited in the wild with publicly available PoC code; upgrade to 7.4.5 or block internet-facing access immediately.

NullSecurityX[verified]@NullSecurityXDisclosure

The post discloses CVE-2026-21643 as a pre‑authentication SQL injection that can lead to remote code execution in FortiClient EMS, and offers search queries to identify affected installations.

Rishi[verified]@rxeriumActive Exploitation

CVE-2026-21643 is a high‑severity SQL injection affecting FortiClientEMS 7.4.4 that is actively exploited in the wild; users should upgrade to 7.4.5 or later or apply vendor patches.

Cyber Security News[verified]@The_Cyber_NewsActive Exploitation

CVE-2026-21643 is a critical SQL injection flaw in Fortinet FortiClient EMS that is being actively exploited in the wild, as attackers inject SQL through the Site header, but the post lacks any PoC, exploitation code, or patch information.

FOFA[verified]@fofabotDisclosure

CVE‑2026‑21643 is a high‑severity pre‑authentication SQL injection in FortiClient EMS 7.4.4, potentially allowing remote code execution via crafted HTTP requests; the post references FOFA search results and the NVD entry.

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediActive Exploitation

The post announces that six CVEs are being actively exploited, as confirmed by CISA’s KEV list, and provides detailed technical information for each vulnerability without offering patches or code.

watchTowr[verified]@watchtowrcyberDisclosure

watchTowr warned its clients about CVE‑2026‑21643 67 days before CISA listed it on KEV, providing early exposure awareness without offering a PoC, exploit code, or patch details.