Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution
Summary: Fortinet released security updates for a critical SQL injection flaw in FortiClientEMS, tracked as CVE-2026-21643 with a CVSS rating of 9.1 out of 10.0, which Fortinet says may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. The flaw was discovered and reported by Gwendal Guégniaud of the Fortinet Product Security team, and Fortinet makes no mention of it being exploited in the wild.
What you should know: This disclosure follows CVE-2026-24858, a 9.4-rated flaw in FortiOS, FortiManager, FortiAnalyzer, FortiProxy and FortiWeb that Fortinet has acknowledged was actively exploited to create local admin accounts for persistence, grant those accounts VPN access, and exfiltrate firewall configurations.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-21643CVE-2026-24858
- Related
- CVE-2026-21643: Fortinet Forti Client EMS SQL Injection Vulnerability Known Exploited Vulnerabilities · Apr 13, 2026CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Jan 27, 2026