Fortinet FortiClient EMS SQL injection actively exploited - no authentication required (CVE-2026-21643)

A CVSS 9.1 SQL injection flaw in Fortinet's FortiClient Endpoint Management Server is now being exploited in the wild - four days before anyone flagged it publicly. An attacker only needs one crafted HTTP request with a malicious Site header to execute arbitrary SQL against the backing PostgreSQL database, no credentials required. Roughly 1,000 to 2,400 FortiClient EMS instances are exposed to the internet, mostly in the US and Europe.

Check

Check if you run FortiClient EMS with its web interface exposed to the internet.

Affected

FortiClient EMS 7.4.4 with multi-tenant mode enabled. Single-site deployments are not affected.

Fix

Upgrade to FortiClient EMS 7.4.5 or later. Restrict access to the EMS administrative interface immediately.