CVE-2026-21643: Critical SQL Injection in Fortinet FortiClient EMS Exploited in the Wild

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

CVE-2026-21643: Critical SQL Injection in Fortinet FortiClient EMS Exploited in the Wild

On February 6, 2026, Fortinet disclosed a critical SQL injection vulnerability in FortiClient Enterprise Management Server (EMS), tracked as CVE-2026-21643. This vulnerability allows unauthenticated attackers to execute arbitrary code or commands on vulnerable systems via specially crafted HTTP requests. With a CVSS score of 9.8 (Critical), CVE-2026-21643 has already been observed under active exploitation in the wild, raising urgent concerns for organizations relying on FortiClient EMS to manage their endpoint security fleet.

Article Link: https://www.picussecurity.com/resource/blog/cve-2026-21643-critical-sql-injection-in-fortinet-forticlient-ems-exploited-in-the-wild