9.1
Critique
Exploitée
CVE-2026-21643 Fortinet SQL Injection Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-89
Description
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| FortiClientEMS | 7.4.4 | Pas de correctif indiqué |
Références
- fortiguard.fortinet.com fortiguard.fortinet.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de FortiClientEMS
Les 22 CVE de FortiClientEMS →
CVE-2026-59836
A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0…
6.7
Moyenne
CVE-2026-39810
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to…
5.2
Moyenne
CVE-2026-39809
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet…
6.2
Moyenne
CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability
9.1
Critique