{"id":"CVE-2026-21643","kind":"vulnerability","aliases":["CVE-2026-21643"],"related":[],"title":"fortinet forticlientems: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet…","description":"WAF Release - 2026-04-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 15, 2026\n\n## WAF Release - 2026-04-15\n\nThis week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).\n\nKey Findings\n\n- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.\n- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.\n- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule \"React Server - DOS - CVE:CVE-2026-23864 - 1\" (ID: ...61680354) |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |","summary":"Fortinet FortiClient EMS, the endpoint management server for FortiClient, has a SQL injection flaw reachable through crafted HTTP requests. An unauthenticated attacker can run unauthorized code or commands on the server, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-04-13T00:00:00+00:00","products":[{"name":"Fortinet FortiClient EMS","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet forticlientems","fixed":[],"affected":"= 7.4.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","exploited","forticlient-ems","fortinet","lab-disclosure","self-hosted","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the mitigation from Fortinet's advisory; if none is available, CISA says to discontinue use of the product. Affected and fixed versions: unknown.","status":"open","published_at":"2026-02-06T09:15:49+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:53+00:00","updated_at":"2026-10-24T19:12:57+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:38:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation from Fortinet's advisory; if none is available, CISA says to discontinue use of the product. Affected and fixed versions: unknown.","reach":"internet","summary":"Fortinet FortiClient EMS, the endpoint management server for FortiClient, has a SQL injection flaw reachable through crafted HTTP requests. An unauthenticated attacker can run unauthorized code or commands on the server, and CISA lists it as actively exploited.","category":"vendor","who_cares":["fortinet","forticlient-ems","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker executes code or commands on the EMS server","analyst_note":"Find Fortinet's PSIRT advisory for CVE-2026-21643 for affected/fixed versions, mitigation steps and IOCs; check the KEV entry for due date.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000449,"input_tokens":2556,"output_tokens":386,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':84C,100C '-15':85C,101C '-20079':138C,175C,325C '-2026':20A,23A,121C,137C,143C,166C,174C,209C,231C,324C,347C,369C,388C,408C '-21643':21A,24A,144C,210C,348C '-23864':389C,409C '-23869':167C '-33057':122C,232C,370C '0af34bba':435C '1':390C,410C '15':95C '2026':83C,96C,99C '50c08f6f':381C '61680354':412C 'access':220C 'action':307C,309C 'activ':79B 'addit':145C 'address':159C 'administr':222C,277C,290C 'aef9415b':314C 'allow':193C,269C 'alongsid':123C 'appli':295C 'april':94C 'arbitrari':200C,248C,274C 'attack':64B,197C,245C,271C 'auth':342C 'base':182C,240C 'base64':255C,365C 'base64-encoded':254C 'beta':391C,424C,443C 'block':327C,350C,372C,393C 'bodi':261C 'bypass':203C 'c953a72b':359C 'center':135C,190C 'changelog':86C,87C 'cisa':75B 'cisco':131C,170C,186C,316C 'cloudflar':30B,93C,311C,333C,356C,378C,413C,432C 'code':68B,114C,249C,275C,363C 'command':13A,70B,201C 'comment':310C 'configur':223C 'control':278C 'could':268C 'coverag':157C 'craft':59B,226C,253C 'critic':112C,212C 'cve':19A,22A,120C,136C,142C,165C,173C,208C,230C,322C,323C,345C,346C,367C,368C,386C,387C,406C,407C 'descript':305C 'detect':109C,332C,355C,377C,431C,450C 'disabl':426C,445C 'disclosur':38B 'dos':156C,385C,405C 'ebd81645':416C 'ee7be621':336C 'element':8A 'em':34B,45B,141C,207C,217C,339C 'emb':440C 'ems':27A 'encod':256C 'encourag':293C 'endpoint':47B 'execut':115C,199C,247C,273C,364C 'exhaust':163C,289C 'exist':153C 'exploit':31B,80B,264C 'filter':205C 'find':169C 'firewal':133C,188C 'flaw':56B 'fmc':172C,191C,318C 'forticli':33B,44B,51B,140C,206C,216C,338C 'forticlient':26A 'forticlient-em':32B 'forticlientem':2A 'forticlientems':29A 'fortinet':1A,18A,25A,28A,35B,43B 'framework':242C 'gain':276C 'high':127C 'high-impact':126C 'host':41B 'html':419C,438C 'http':60B,227C 'id':301C,304C,411C 'identifi':161C 'impact':128C,262C 'improp':4A 'improv':91C 'includ':148C 'infrastructur':282C 'inject':15A,55B,344C,420C,439C 'interfac':184C 'introduc':106C 'key':168C 'lab':37B 'lab-disclosur':36B 'legaci':302C 'link':421C 'list':76B 'log':326C,349C,371C,392C 'manag':48B,134C,183C,189C,281C,312C,334C,357C,379C,414C,433C 'manipul':224C 'merg':398C 'mesop':119C,229C,237C,361C 'n/a':315C,337C,360C,382C,417C,425C,436C,444C 'network':280C 'neutral':5A 'new':88C,108C,308C,331C,354C,376C,430C,449C 'offici':296C 'origin':401C 'payload':257C,366C 'permit':218C 'pre':341C 'pre-auth':340C 'previous':306C 'protect':124C 'python':239C 'python-bas':238C 'rce':116C,319C 'reachabl':57B 'react':154C,383C,403C 'recent':160C 'releas':82C,98C,105C,147C 'remot':113C,196C,362C 'request':61B,228C,260C 'resourc':162C,288C 'rule':300C,303C,395C,402C 'ruleset':299C,313C,335C,358C,380C,415C,434C 'run':66B 'secur':132C,171C,187C,204C,317C 'self':40B 'self-host':39B 'send':251C 'server':49B,73B,155C,286C,384C,404C 'server-sid':285C 'side':287C 'special':7A,252C 'sql':12A,14A,54B,343C 'strong':292C 'success':263C 'tag':422C,441C 'trigger':284C 'ui':241C 'unauthent':63B,195C,244C,270C 'unauthor':67B,219C 'updat':89C,150C,298C 'upgradereadinesscal':321C 'uri':423C,442C 'use':9A 'vector':164C 'vendor':42B,297C 'via':225C,320C 'vulner':16A,117C,129C,177C,213C,234C,267C 'waf':81C,97C 'web':181C 'web-bas':180C 'week':103C 'xss':418C,437C","nicknames":[],"mitigations":[{"kind":"waf-rule","scope":null,"since":"2026-04-15","covers":"HTTP requests matched by the Cloudflare Managed Ruleset rule for FortiClient EMS pre-auth SQL injection (action changed from Log to Block)","limits":"none stated","source":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","vendor":"Cloudflare","seen_at":"2026-10-24T19:12:01Z","confidence":0.9,"source_title":"WAF Release - 2026-04-15 · Changelog","customer_action":"apply official vendor updates from Fortinet, which the rule does not replace"}],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-02-06T09:15:49+00:00","kev":{"dateAdded":"2026-04-13","dueDate":"2026-04-16","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-21643","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21643","severity":null,"published_at":"2026-04-13T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-21643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21643","severity":null,"published_at":"2026-02-06T09:15:49+00:00","modified_at":"2026-06-17T10:18:51+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null},{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/#CVE-2026-21643","url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","severity":null,"published_at":"2026-04-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-15 · Changelog"}],"documents":[{"id":2921,"url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","title":"Cloudflare: WAF Release - 2026-04-15 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-15 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 15, 2026\n\n## WAF Release - 2026-04-15\n\nThis week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869).\n\nKey Findings\n\n- Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters.\n- FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests.\n- Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body.\n\nImpact\n\nSuccessful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule \"React Server - DOS - CVE:CVE-2026-23864 - 1\" (ID: ...61680354) |\n| Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. |","published_at":"2026-04-15T00:00:00+00:00","relation":"advisory","confidence":null,"note":"Cloudflare disclosure page"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}