CVE-2026-21643: 
FortiClient EMS vulnerability analysis and mitigation

CVE-2026-21643 is a critical SQL injection vulnerability in Fortinet FortiClientEMS 7.4.4 that allows unauthenticated remote attackers to execute arbitrary code or commands via specially crafted HTTP requests. The vulnerability was publicly disclosed on February 6, 2026, and affects FortiClientEMS versions 7.4.0 through 7.4.4; versions 7.2.x, 7.4.5+, and 8.0 are not affected. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 9.1 (Critical) per Fortinet's own advisory (FortiGuard PSIRT, CISA KEV).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and stems from insufficient sanitization of user-supplied input in HTTP request headers processed by the FortiClientEMS API. Specifically, the Site HTTP header value is passed unsanitized into a PostgreSQL search_path or similar SQL context at the /api/v1/init_consts endpoint, enabling error-based and time-based SQL injection without any authentication (FortiGuard PSIRT, Bishop Fox). Public PoC code demonstrates injection via the Site header with payloads such as 1; SELECT version()--, which can leak database version information and be chained to achieve OS command execution through PostgreSQL functions (GitHub PoC). Attackers can also bypass WAF protections by injecting payloads through HTTP headers rather than standard query parameters (Undercode Testing).

Successful exploitation allows an unauthenticated network attacker to execute arbitrary code or commands on the FortiClientEMS server, resulting in full compromise of confidentiality, integrity, and availability of the affected system. Attackers can exfiltrate sensitive endpoint management data (including managed device configurations and credentials), manipulate the database, and potentially pivot to managed endpoints across the enterprise network. The vulnerability has been weaponized by the Medusa ransomware group and threat actor Storm-1175, indicating high risk of ransomware deployment and lateral movement following initial access (CISA KEV, Feedly).

1. Reconnaissance: Use Shodan, Censys, or FOFA to identify internet-facing FortiClientEMS instances running version 7.4.4 (or 7.4.0–7.4.4). Look for the FortiClientEMS web interface on standard HTTPS ports.
2. Identify the vulnerable endpoint: Target the unauthenticated API endpoint /api/v1/init_consts, which processes the Site HTTP header without sanitization.
3. Craft the SQL injection payload: Inject a malicious SQL payload into the Site header, e.g., Site: tenant1; SELECT version()--. This bypasses WAF rules that inspect query parameters, as the injection occurs in an HTTP header.
4. Confirm vulnerability: Send the crafted GET request and observe the response for PostgreSQL error messages or version strings, confirming error-based SQL injection.
5. Escalate to RCE: Chain the SQL injection with PostgreSQL-specific functions (e.g., COPY TO/FROM PROGRAM, pg_read_file) or leverage superuser privileges to write a web shell or execute OS commands on the underlying server.
6. Establish persistence: Deploy a reverse shell, web shell, or implant (e.g., Medusa ransomware payload) to maintain access and move laterally to managed endpoints via the EMS management plane (GitHub PoC, Bishop Fox).

• Network: Unusual HTTP GET/POST requests to /api/v1/init_consts with anomalous or SQL-containing Site header values (e.g., containing ;, SELECT, pg_sleep, version(), COPY); unexpected outbound connections from the FortiClientEMS server to unknown external IPs.
• Logs: FortiClientEMS access logs showing repeated requests to /api/v1/init_consts from single or rotating IPs; PostgreSQL error messages or stack traces in application logs referencing SQL syntax errors or unexpected query results; authentication events from unexpected source IPs.
• File System: Unexpected web shells or script files in the FortiClientEMS web root or temp directories; new executable files or DLLs dropped by the EMS service account; modified configuration files.
• Process: Unusual child processes spawned by the FortiClientEMS service or PostgreSQL process (e.g., cmd.exe, powershell.exe, bash, curl, wget); unexpected database utility processes (e.g., psql) running outside normal maintenance windows.
• Database: Unexpected new database users or privilege escalations in the PostgreSQL instance; unusual COPY commands or pg_read_file/pg_write_file calls in PostgreSQL logs (CISA KEV, Picus Security).

Fortinet has released a patch in FortiClientEMS version 7.4.5; organizations running 7.4.0–7.4.4 should upgrade immediately (FortiGuard PSIRT). As interim workarounds, restrict HTTP access to the FortiClientEMS management interface to trusted IP ranges only using firewall rules or network segmentation, and disable internet-facing exposure of the EMS server where possible. Deploy WAF rules to detect SQL injection patterns in HTTP headers (note that attackers have been observed bypassing standard WAF rules via header injection). CISA mandated federal agencies patch by April 16, 2026 under BOD 22-01 (CISA KEV). Monitor FortiClientEMS logs for anomalous requests to /api/v1/init_consts as a detection measure.

Fortinet's PSIRT acknowledged active exploitation in the wild in their advisory, noting the vulnerability was internally discovered by Gwendal Guégniaud of the Fortinet Product Security team (FortiGuard PSIRT). CISA added CVE-2026-21643 to its KEV catalog on April 13, 2026, and issued an alert requiring federal agencies to patch within three days, reflecting the severity of active exploitation (CISA KEV). Security researchers at Bishop Fox, Arctic Wolf, Horizon3.ai, and Picus Security published detailed technical analyses and PoC demonstrations, with Bishop Fox confirming the Site header injection vector (Bishop Fox). The vulnerability received widespread coverage from BleepingComputer, SecurityWeek, The Hacker News, and Dark Reading, with community discussion on Reddit and social media highlighting the risk to enterprise environments. The Belgian CCB and Canadian CCCS also issued urgent advisories urging immediate patching (CCB Belgium, Canadian CCCS).