Fortinet FortiClientEMS SQL Injection (CVE-2026-21643)

Fortinet's advisory FG-IR-25-1142, titled "SQLi in administrative interface," describes an improper neutralization of special elements in an SQL command (CWE-89). It says this may let an unauthenticated attacker "execute unauthorized code or commands via specifically crafted HTTP requests." Fortinet lists the component as the GUI and the severity as Critical.

Fortinet says its own Product Security team found the flaw internally and credits Gwendal Guégniaud. The SQL injection glossary entry explains the bug class.

Where the Injection Sits

Bishop Fox, which published its own analysis on 9 March 2026, traced the bug to the multi-tenant "Sites" feature. It says FortiClientEMS 7.4.4 copies the HTTP Site header into a PostgreSQL SET search_path statement without any filtering. That happens before the login check runs.

Bishop Fox confirmed the injection in a lab on two pre-authentication endpoints, /api/v1/auth/signin and /api/v1/init_consts. It says the second returns database errors in the response body and has no lockout, so an attacker can read data one request at a time. Bishop Fox also says single-site installs are not affected, a point Fortinet's advisory does not state.

What an Attacker Gains

Bishop Fox says a successful request runs arbitrary SQL with the rights of the EMS database user. It reports that in the virtual machine image Fortinet ships, that user is a PostgreSQL superuser. In its lab that allowed file creation on the host as the postgres system user.

The researchers also list admin password hashes, API tokens, the endpoint inventory and ZTNA certificates as data within reach. Those are lab findings from Bishop Fox, not statements from Fortinet.

Exploitation Signals for CVE-2026-21643

CISA added the flaw to KEV on 13 April 2026, 66 days after Fortinet published the advisory. We checked these public signals on 4 November 2026.

The advisory's two statements about exploitation disagree, so we rely on the KEV listing and the SSVC entry. The CVE record's CISA enrichment also lists a GitHub exploit link among its references.

Fortinet has other management-plane flaws on this site, such as the FortiManager missing authentication flaw CVE-2024-47575. FortiClientEMS is a separate product with its own fix path.

Fortinet's advisory lists one affected release in one product family. FortiClientEMS 7.4.4 is the only affected version, and 7.4.5 is the fix. The record's CPE entry and NVD agree.

The advisory timeline says Fortinet removed FortiEMS Cloud on 6 February 2026 because it is not affected. Bishop Fox adds that the vulnerable code was introduced in a 7.4.4 refactoring and replaced in 7.4.5, so the flaw lived for one release.

Bishop Fox says the fix switched to parameterized identifier handling. We recommend upgrading even if you believe multi-tenant mode is off. Our patch management entry covers how to verify a rollout.