CVE-2026-21643

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

94.08% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-04-13

Nuclei

critical · CWE-89

Published

2026-02-06

Updated

2026-04-14

Proof-of-concept exploits (3)

• 0xBlackash/CVE-2026-2164318★ · 2026-03-28
• alirezac0/CVE-2026-216435★ · 2026-03-27
• samael0x4/CVE-2026

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-21643.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-27502
• CVE-2026-0770
• CVE-2026-21962
• CVE-2026-55450
• CVE-2026-2164
• CVE-2026-2165