--- id: "CVE-2026-21643" kind: "vulnerability" aliases: ["CVE-2026-21643"] title: "fortinet forticlientems: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Fortinet FortiClient EMS", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fortinet forticlientems", "fixed": [], "affected": "= 7.4.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cloudflare", "exploited", "forticlient-ems", "fortinet", "lab-disclosure", "self-hosted", "vendor"] not_affected_if: ["managed-hosting"] published_at: "2026-02-06T09:15:49+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T19:12:57+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21643", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21643", "first_seen_at": "2026-10-23T23:44:51+00:00"}, {"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/", "first_seen_at": "2026-10-24T19:12:57+00:00"}] --- # fortinet forticlientems: An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet… Fortinet FortiClient EMS, the endpoint management server for FortiClient, has a SQL injection flaw reachable through crafted HTTP requests. An unauthenticated attacker can run unauthorized code or commands on the server, and CISA lists it as actively exploited. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Fortinet FortiClient EMS affected ? fixed ? - vendor:fortinet forticlientems affected = 7.4.4 fixed ? ## Fix Apply the mitigation from Fortinet's advisory; if none is available, CISA says to discontinue use of the product. Affected and fixed versions: unknown. ## Mitigated for you by - Cloudflare (waf-rule, since 2026-04-15): covers HTTP requests matched by the Cloudflare Managed Ruleset rule for FortiClient EMS pre-auth SQL injection (action changed from Log to Block) Limits: none stated Still: apply official vendor updates from Fortinet, which the rule does not replace https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21643 - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-21643 - 2026-10-24T19:12:57+00:00 lab https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ — Cloudflare: WAF Release - 2026-04-15 · Changelog ## Documents - [advisory] Cloudflare: WAF Release - 2026-04-15 · Changelog https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/ ## From the sources WAF Release - 2026-04-15 · Changelog # Changelog New updates and improvements at Cloudflare. April 15, 2026 ## WAF Release - 2026-04-15 This week's release introduces a new detection for a critical Remote Code Execution (RCE) vulnerability in Mesop (CVE-2026-33057), alongside protections for high-impact vulnerabilities in Cisco Secure Firewall Management Center (CVE-2026-20079) and FortiClient EMS (CVE-2026-21643). Additionally, this release includes an update to our existing React Server DoS coverage to address recently identified resource exhaustion vectors (CVE-2026-23869). Key Findings - Cisco Secure FMC (CVE-2026-20079): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) that allows an unauthenticated, remote attacker to execute arbitrary commands or bypass security filters. - FortiClient EMS (CVE-2026-21643): A critical vulnerability in the FortiClient EMS permitting unauthorized access or administrative configuration manipulation via crafted HTTP requests. - Mesop (CVE-2026-33057): A vulnerability in the Mesop Python-based UI framework where unauthenticated attackers can execute arbitrary code by sending specially crafted, Base64-encoded payloads in the request body. Impact Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, gain administrative control over network management infrastructure, or trigger server-side resource exhaustion. Administrators are strongly encouraged to apply official vendor updates. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...aef9415b | N/A | Cisco Secure FMC - RCE via upgradeReadinessCall - CVE:CVE-2026-20079 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...ee7be621 | N/A | FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...c953a72b | N/A | Mesop - Remote Code Execution - Base64 Payload - CVE:CVE-2026-33057 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...50c08f6f | N/A | React Server - DOS - CVE:CVE-2026-23864 - 1 - Beta | Log | Block | This rule has been merged into the original rule "React Server - DOS - CVE:CVE-2026-23864 - 1" (ID: ...61680354) | | Cloudflare Managed Ruleset | ...ebd81645 | N/A | XSS, HTML Injection - Link Tag - URI (beta) | N/A | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...0af34bba | N/A | XSS, HTML Injection - Embed Tag - URI (beta) | N/A | Disabled | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_