Fortinet Releases Security Updates for Critical SQL Injection Vulnerability

Fortinet has recently released security updates to address a critical flaw in FortiClientEMS, which could lead to the execution of arbitrary code on susceptible systems. The vulnerability, tracked as CVE-2026-21643, has a CVSS rating of 9.1 out of a maximum of 10.0, indicating a high level of severity.

The vulnerability is caused by an improper neutralization of special elements used in an SQL Command, also known as a SQL Injection (SQLi) vulnerability. This type of vulnerability can allow attackers to inject malicious SQL code into a web application's database, potentially leading to unauthorized access, data modification, or even code execution.

Also Read: BeyondTrust Patches Critical RCE Vulnerability in Remote Support and PRA
  • The vulnerability affects FortiClientEMS and has a CVSS rating of 9.1.
  • Attackers can exploit the vulnerability to execute arbitrary code on susceptible systems.
  • Fortinet has released security updates to address the vulnerability.

It is essential for organizations using FortiClientEMS to apply the security updates as soon as possible to prevent potential attacks. Additionally, organizations should ensure that their systems and applications are up-to-date with the latest security patches to prevent exploitation of known vulnerabilities.

Passwords are like underwear. Don’t let people see it, change it very often, and don’t share it with strangers.

Chris Pirillo