CVE-2026-21643: FortiClient EMS Critical SQL Injection — Actively Exploited, No Credentials Required

CVE ID: CVE-2026-21643 · CVSS: 9.3 (Critical) · Affected: FortiClient EMS 7.4.4 (multi-tenant mode) · Fix: Upgrade to 7.4.5

What Happened

A critical SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) is now being actively exploited in real-world attacks. The flaw, tracked as CVE-2026-21643, allows a remote, unauthenticated attacker to execute arbitrary SQL commands against the backend PostgreSQL database — with a single HTTP request.

No credentials needed. No user interaction required. Just one crafted HTTP header.

How the Vulnerability Works

FortiClient EMS v7.4.4 introduced a refactored middleware stack for its multi-tenant deployment feature. As part of that change, the HTTP header used to identify which tenant a request belongs to gets passed directly into a database query — without any sanitization — and before any authentication check.

According to Bishop Fox's technical analysis published in early March, an attacker who can reach the EMS web interface over HTTPS can exploit this in a single request. The result: full access to admin credentials, endpoint inventory data, security policies, and certificates for managed endpoints.

In simple terms: one request to the management server, and the attacker sees everything — every endpoint, every policy, every certificate in your network.

The Exploitation Timeline

• February 6, 2026 — Fortinet discloses CVE-2026-21643 and releases FortiClient EMS 7.4.5 as the fix
• Early March 2026 — Bishop Fox publishes a technical deep dive, mapping practical exploitation paths
• March 25, 2026 — First exploitation observed in the wild, according to threat intelligence firm Defused Cyber
• March 29, 2026 — Defused Cyber publicly reports active exploitation via X (Twitter) and LinkedIn
• March 30, 2026 — Multiple security outlets (Help Net Security, Arctic Wolf, Codebook Japan) confirm the threat

At the time of writing, CISA has not yet added CVE-2026-21643 to its Known Exploited Vulnerabilities (KEV) catalog, and Fortinet's own advisory has not been updated to reflect active exploitation. But the attacks are already happening.

Why FortiClient EMS Is a High-Value Target

FortiClient EMS isn't just another web application. It's the central management server that controls FortiClient endpoint agents deployed across an organization's entire device fleet — Windows, macOS, Linux, iOS, Android.

Compromising EMS means:

• Admin credential theft — Full access to the management console
• Endpoint inventory exposure — Attackers learn exactly what devices exist in the network
• Security policy manipulation — Disable protections, create exceptions, open backdoors
• Certificate access — Certificates used for managed endpoint authentication
• Lateral movement — From the management server to every endpoint it controls

This follows a pattern we've seen repeatedly in 2026: the security management tool becomes the attack vector. We saw it with Cisco FMC (CVE-2026-20079), F5 BIG-IP APM (CVE-2025-53521), and now FortiClient EMS.

Who Is Affected

Only FortiClient EMS version 7.4.4 is vulnerable. Versions 7.2 and 8.0 are not affected.

Bishop Fox further narrows the scope: single-site deployments are not affected. The vulnerability specifically impacts multi-tenant mode deployments where the tenant-identification header is processed.

However, Shodan data from Defused Cyber shows approximately 1,000 FortiClient EMS instances publicly exposed on the internet. The Shadowserver Foundation tracks over 2,000 exposed instances, with more than 1,400 IPs in the United States and Europe.

What You Should Do

Immediate Actions

1. Check your FortiClient EMS version. If you're running 7.4.4, upgrade to 7.4.5 immediately.
2. Restrict access to the EMS web interface. It should not be directly exposed to the internet.
3. Review logs for unusual HTTP requests targeting the EMS management interface, particularly requests with anomalous tenant-identification headers.
4. Check for indicators of compromise. If exploitation occurred before patching, the attacker may have already extracted credentials and endpoint data.

Post-Patch Verification

Patching alone may not be enough if exploitation already occurred. Organizations should:

• Rotate admin credentials for the EMS console
• Audit endpoint certificates issued through EMS
• Review security policies for unauthorized modifications
• Monitor endpoint agent behavior for anomalies

CISA KEV Watch

CVE-2026-21643 is not yet listed on the CISA Known Exploited Vulnerabilities catalog. Given the confirmed active exploitation, KEV addition is likely imminent — similar to what we saw with CVE-2026-3055 (Citrix NetScaler), which moved from initial exploitation reports to KEV listing in under a week.

Organizations using VulnTracker can monitor this CVE's exploit intelligence status in real time. When CISA adds it to KEV or when EPSS scores update, VulnTracker's exploit alerts will notify you immediately — so you're not waiting for the next news cycle to find out.

The Bigger Picture: Fortinet's Track Record

This isn't the first time Fortinet products have been targeted. CISA's KEV catalog already includes multiple Fortinet vulnerabilities exploited in ransomware campaigns and cyber espionage operations. The pattern is consistent: Fortinet appliances sit at the network perimeter, manage critical security functions, and represent high-value targets for attackers seeking initial access.

CVE-2026-21643 adds FortiClient EMS to the list of Fortinet products that have transitioned from disclosed vulnerability to confirmed exploitation. For organizations running Fortinet infrastructure, this is another reminder that patching Fortinet advisories should be treated as urgent — not routine.

Track CVE-2026-21643 on VulnTracker. Stay ahead of exploitation status changes, CISA KEV additions, and EPSS score updates — the moment they happen, not when the next article drops.