CVE-2026-21643: Critical SQL Injection in Fortinet FortiClient EMS Exploited in the Wild

On February 6, 2026, Fortinet disclosed a critical SQL injection vulnerability in FortiClient Enterprise Management Server (EMS), tracked as CVE-2026-21643. This vulnerability allows unauthenticated attackers to execute arbitrary code or commands on vulnerable systems via specially crafted HTTP requests. With a CVSS score of 9.8 (Critical), CVE-2026-21643 has already been observed under active exploitation in the wild, raising urgent concerns for organizations relying on FortiClient EMS to manage their endpoint security fleet.

In this blog, we explain how the FortiClient EMS CVE-2026-21643 vulnerability works and provide practical steps for validation and remediation.

Simulate Vulnerability Exploitation Attacks with 14-Day Free Trial of Picus Platform

FortiClient EMS CVE-2026-21643 Vulnerability Explained

FortiClient Enterprise Management Server (EMS) is Fortinet's centralized management platform for FortiClient endpoint agents. Organizations use it to deploy, configure, and monitor FortiClient installations across their entire endpoint fleet. FortiClient EMS provides a web-based GUI served over HTTPS that allows administrators to manage endpoint policies, security profiles, software deployments, and Zero Trust Network Access (ZTNA) configurations from a single console.

On February 6, 2026, Fortinet released a security advisory for a critical SQL injection vulnerability in FortiClient Enterprise Management Server (EMS) [1]. This vulnerability, which affects FortiClient EMS version 7.4.4 with multi-tenant mode enabled, allows unauthenticated attackers to execute arbitrary code or commands. CVE-2026-21643 has a CVSS score of 9.8 (Critical) due to its pre-authentication attack vector and the severity of its impact. Organizations are advised to upgrade their vulnerable FortiClient EMS installations to the patched versions.

How FortiClient EMS CVE-2026-21643 Exploit Works

CVE-2026-21643 is an SQL injection vulnerability in the FortiClient EMS web interface caused by improper handling of the Site HTTP header. Introduced in version 7.4.4 during middleware refactoring, the application began passing this header directly into a database query without validation and, crucially, before authentication. When a request reaches the EMS server, the attacker-controlled Site header is used to set the PostgreSQL search_path. Because this value is injected via string interpolation, an attacker can break out of the query context and execute arbitrary SQL commands. The flaw is exploitable without credentials through pre-authentication endpoints such as /api/v1/init_consts, allowing attackers to send a single crafted HTTP request to gain database-level access. From there, they can escalate to remote code execution, extract sensitive data, and modify system configurations.

How Picus Helps Simulate FortiClient EMS CVE-2026-21643 Attacks?

We also strongly suggest simulating the FortiClient EMS CVE-2026-21643 vulnerability to test the effectiveness of your security controls against sophisticated cyber attacks using the Picus Security Validation Platform. You can also test your defenses against other vulnerability exploitation attacks, such as regreSSHion, Citrix Bleed, and Follina, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for FortiClient EMS CVE-2026-21643 exploitation attacks:

Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address FortiClient EMS CVE-2026-21643 vulnerability exploitation attacks in preventive security controls. Currently, Picus Labs has validated the following signatures for FortiClient EMS CVE-2026-21643 vulnerability:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial  of the Picus Security Validation Platform.

References

[1] "PSIRT Advisory FG-IR-25-1142 - SQLi in Administrative Interface," Fortinet. Available: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142