CVE-2026-21643

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected

Fortinet · FortiClientEMS

CVSS v3.1 FORTINET

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

93.87% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-04-13

Nuclei

critical · CWE-89

Published

2026-02-06

Updated

2026-04-14

Proof-of-concept exploits (3)

• 0xBlackash/CVE-2026-2164318★ · 2026-03-28
• alirezac0/CVE-2026-216435★ · 2026-03-27
• samael0x4/CVE-20261★ · 2026-08-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21643.yaml

Security advisories

• https://fortiguard.fortinet.com/psirt/FG-IR-25-1142

References

• CVE Record
• NVD entry

Related

• CVE-2022-27502
• CVE-2026-0770
• CVE-2026-21962
• CVE-2026-55450