CVE-2026-21643

CRITICAL9.1

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7

Published Feb 6, 2026

Modified 4 days ago

Details

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

Affected Packages

FortiClient

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Affected versions:

7.4.4

References

ADVISORY

https://fortiguard.fortinet.com/psirt/FG-IR-25-1142

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-21643

Aliases

FG-IR-25-1142