Fortinet: Critical Fortinet FortiClient EMS Vulnerability Allows Remote Code Execution

Critical SQL Injection Flaw in Fortinet FortiClient EMS Exposes Organizations to Remote Attacks

A severe security vulnerability in Fortinet’s FortiClient EMS (Endpoint Management Server) has been disclosed, allowing unauthenticated attackers to execute remote code on vulnerable systems. Tracked as CVE-2026-21643, the flaw was revealed on February 6, 2026, and carries a CVSS score of 9.1, classifying it as critical.

The vulnerability stems from an SQL injection (SQLi) flaw in the FortiClient EMS administrative interface, where improper sanitization of user input enables attackers to manipulate database queries. Exploitation requires no authentication attackers can send crafted HTTP requests to vulnerable servers over the network, potentially leading to full system compromise. Consequences include data theft, malware deployment, or lateral movement within an organization’s network.

The flaw affects FortiClient EMS version 7.4.4 exclusively. Versions 7.2 and 8.0, as well as FortiEMS Cloud users, remain unaffected. Fortinet has released version 7.4.5 to patch the issue, urging organizations to upgrade immediately. The vulnerability was discovered internally by Gwendal Guégniaud of Fortinet’s Product Security team, highlighting the role of proactive security research in mitigating risks.

System administrators are advised to prioritize patching, verify vulnerable installations, and monitor network logs for suspicious activity targeting the administrative interface. The swift disclosure timeline underscores the severity of the threat.

Source: https://gbhackers.com/critical-fortinet-forticlient-ems-vulnerability/

Fortinet cybersecurity rating report: https://www.rankiteo.com/company/fortinet

"id": "FOR1770630779",
"linkid": "fortinet",
"type": "Vulnerability",
"date": "2/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Organizations using FortiClient '
                                              'EMS version 7.4.4',
                        'industry': 'Cybersecurity',
                        'name': 'Fortinet',
                        'type': 'Vendor'}],
 'attack_vector': 'Network',
 'customer_advisories': 'Upgrade to FortiClient EMS version 7.4.5 immediately.',
 'data_breach': {'data_exfiltration': 'Potential data theft'},
 'date_detected': '2026-02-06',
 'date_publicly_disclosed': '2026-02-06',
 'description': 'A severe security vulnerability in Fortinet’s FortiClient EMS '
                '(Endpoint Management Server) has been disclosed, allowing '
                'unauthenticated attackers to execute remote code on '
                'vulnerable systems. The flaw stems from an SQL injection '
                '(SQLi) flaw in the FortiClient EMS administrative interface, '
                'where improper sanitization of user input enables attackers '
                'to manipulate database queries. Exploitation requires no '
                'authentication and can lead to full system compromise, '
                'including data theft, malware deployment, or lateral movement '
                'within an organization’s network.',
 'impact': {'data_compromised': 'Potential data theft',
            'operational_impact': 'Full system compromise, lateral movement '
                                  'within network',
            'systems_affected': 'FortiClient EMS version 7.4.4'},
 'lessons_learned': 'Proactive security research and swift patching are '
                    'critical to mitigating risks.',
 'post_incident_analysis': {'corrective_actions': 'Patch released (version '
                                                  '7.4.5)',
                            'root_causes': 'Improper sanitization of user '
                                           'input in the FortiClient EMS '
                                           'administrative interface'},
 'recommendations': 'System administrators should prioritize patching, verify '
                    'vulnerable installations, and monitor network logs for '
                    'suspicious activity targeting the administrative '
                    'interface.',
 'references': [{'source': 'Fortinet Security Advisory'}],
 'response': {'communication_strategy': 'Public disclosure and advisory',
              'containment_measures': 'Patch to version 7.4.5',
              'enhanced_monitoring': 'Monitor network logs for suspicious '
                                     'activity',
              'remediation_measures': 'Upgrade to FortiClient EMS version '
                                      '7.4.5'},
 'title': 'Critical SQL Injection Flaw in Fortinet FortiClient EMS Exposes '
          'Organizations to Remote Attacks',
 'type': 'SQL Injection',
 'vulnerability_exploited': 'CVE-2026-21643'}