CVE-2026-39809General(fortinet / forticlientems)

LOWCVSS 6.7 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch fortinet forticlientems systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via sending crafted requests

fortinet CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://fortiguard.fortinet.com/psirt/FG-IR-26-102

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

forticlientems

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 1d ago at 2 mentions (2026-04-14); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

fortinet

Products

forticlientems

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

General

250.0%

Patch

125.0%

Disclosure

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-14	2	General1Patch1
2026-04-19	2	Disclosure1General1

Full discourse4 posts

Kaitan ID Security@KaitanSecurity177d
Patch
🚨 Fortinet — FortiClientEMS SQLi CVE-2026-39809 | CWE-89 | CVSS 7.1 Authenticated attacker can run arbitrary SQL via crafted requests. Fixed: 7.4.6+, 7.2.13+ → https://sec.kaitan.id #Fortinet #CVE #InfoSec
Post summary
The post announces the Fortinet FortiClientEMS SQLi vulnerability CVE-2026-39809, outlines its technical details and severity, and informs that versions 7.4.6+ and 7.2.13+ contain a fix.
0101041
144 followersView on X
Infoflowcloud@infoflowcloud172d
Disclosure
🚨*CVE* CVE-2026-39809 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.… https://www.cve.org/CVERecord?id=CVE-2026-39809 ----- Traducción: CVE-2026-39809 Neu… http://infoflow.cloud`
Post summary
The text announces CVE‑2026‑39809 as an SQL injection vulnerability affecting Fortinet FortiClientEMS 7.4.x, but does not provide a PoC, exploit, active exploitation data, or patch information.
0000037
72 followersView on X
CVE@CVEnew172d
General
CVE-2026-39809 A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.… https://www.cve.org/CVERecord?id=CVE-2026-39809
Post summary
The post identifies a SQL injection vulnerability (CVE‑2026‑39809) in Fortinet FortiClientEMS with basic technical details, but it does not mention any PoC, exploit, patch, or active exploitation activity.
00000181
57.2K followersView on X
0day Signal@0dayPublishing177d
General
⚡ CVE-2026-39809: Fortinet (CVSS: 6.2)... SQL injection in FortiClientEMS with high privileges required but full system compromise potential - classic enterprise... https://zerodaysignal.com/vulnerability/CVE-2026-39809 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post mentions a SQL injection vulnerability (CVE‑2026‑39809) in FortiClientEMS that could lead to full system compromise, noting high privilege requirement and a CVSS score of 6.2, but does not provide PoC, exploit code, or patch details.
0000070
218 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	fortinet	forticlientems	-	-	-

Explore more

Back to dashboard fortinet CVEs forticlientems vulnerabilities

What researchers are saying

CVE-2026-39809

Kaitan ID Security[verified]@KaitanSecurityPatch

The post announces the Fortinet FortiClientEMS SQLi vulnerability CVE-2026-39809, outlines its technical details and severity, and informs that versions 7.4.6+ and 7.2.13+ contain a fix.

Infoflowcloud@infoflowcloudDisclosure

The text announces CVE‑2026‑39809 as an SQL injection vulnerability affecting Fortinet FortiClientEMS 7.4.x, but does not provide a PoC, exploit, active exploitation data, or patch information.

CVE@CVEnewGeneral

The post identifies a SQL injection vulnerability (CVE‑2026‑39809) in Fortinet FortiClientEMS with basic technical details, but it does not mention any PoC, exploit, patch, or active exploitation activity.

0day Signal@0dayPublishingGeneral

The post mentions a SQL injection vulnerability (CVE‑2026‑39809) in FortiClientEMS that could lead to full system compromise, noting high privilege requirement and a CVSS score of 6.2, but does not provide PoC, exploit code, or patch details.