CVE-2026-21643

As of 2026-04-16, CVE-2026-21643 is a CVSS 9.8 (CRITICAL-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 62.5%. Threadlinqs Intelligence tracks 2 threats exploiting it.

Last updated: 2026-04-16

Unauthenticated SQL injection vulnerability in Fortinet FortiClient EMS (CWE-89). FortiClient EMS operates as the central management plane for Fortinet endpoint security stack. The flaw allows a remote attacker to execute unauthorized code or commands via crafted HTTP requests without authentication. Actively exploited against internet-exposed EMS instances. CISA KEV added 2026-04-13 with accelerated remediation deadline 2026-04-16. Parallels the 2024 FortiClient EMS SQLi (CVE-2023-48788) exploitation pattern.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

• CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Enables Unauthenticated RCE — Actively Exploited in the Wild — CRITICAL
• CISA KEV Catalog Update: Seven Actively Exploited Vulnerabilities Added 2026-04-13 (Microsoft, Adobe, Fortinet) — CRITICAL

References

• https://fortiguard.fortinet.com/psirt/FG-IR-25-1142
• https://github.com/0xBlackash/CVE-2026-21643/blob/main/cve-2026-21643.py
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21643

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.