CVE-2026-21643: CRITICAL SQL INJECTION IN FORTICLIENTEMS

Summary from the TLDR InfoSec newsletter

Fortinet has patched CVE-2026-21643, a critical SQL injection vulnerability in the FortiClientEMS GUI that allows unauthenticated remote attackers to execute arbitrary code or commands by improperly neutralizing special characters in SQL queries. The flaw affects FortiClientEMS version 7.4.4. Version 7.4.5 was released as a fix. Versions 7.2 and 8.0 are unaffected. While no exploitation in the wild or public proof-of-concept has been observed yet, organizations should patch urgently, given Fortinet's history as a heavily targeted vendor per CISA's Known Exploited Vulnerabilities Catalog.