What is CVE-2026-21643?
Unauthenticated SQL injection vulnerability in Fortinet FortiClient EMS (CWE-89). FortiClient EMS operates as the central management plane for Fortinet endpoint security stack. The flaw allows a remote attacker to execute unauthorized code or commands via crafted HTTP requests without authentication. Actively exploited against internet-exposed EMS instances. CISA KEV added 2026-04-13 with accelerated remediation deadline 2026-04-16. Parallels the 2024 FortiClient EMS SQLi (CVE-2023-48788) exploitation pattern.
The record classifies CVE-2026-21643 under weakness class CWE-89. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 267 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 93.8% probability of exploitation in the next 30 days, higher than 99.8% of all scored CVEs
- CISA KEV
- Listed since 2026-04-13, federal remediation deadline 2026-04-16
- Threadlinqs priority
- 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
- Published
- 2026-02-06, last modified 2026-04-14
Is CVE-2026-21643 being exploited?
CISA added CVE-2026-21643 to the Known Exploited Vulnerabilities catalog on 2026-04-13, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-04-16 under BOD 22-01. Weaponised exploit code for CVE-2026-21643 is publicly available. 3 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2026/CVE-2026-21643.yaml). It currently carries a trending score of 60 in the Threadlinqs vulnerability feed.
- 0xBlackash/CVE-2026-21643 (github)
- alirezac0/CVE-2026-21643 (github)
- trickest/cve (trickest)
Affected products and versions
- (vendor unspecified): Fortinet FortiClient EMS
How to fix CVE-2026-21643
Vendor advisory: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142. Because CVE-2026-21643 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-04-16. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2026-21643
4 tracked threats in the Threadlinqs corpus reference CVE-2026-21643, either in the campaign’s CVE list or as an indicator on the campaign record.
- ProjectDiscovery Nuclei Templates April 2026: detection coverage for exploited/KEV-listed CVEs (cPanel & WHM CVE-2026-41940, Langflow CVE-2026-33017, FortiClientEMS) and AI/LLM platforms — CRITICAL · 2026-10-31
- CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Enables Unauthenticated RCE — Actively Exploited in the Wild — CRITICAL · 2026-04-16
- CISA KEV Catalog Update: Seven Actively Exploited Vulnerabilities Added 2026-04-13 (Microsoft, Adobe, Fortinet) — CRITICAL · 2026-04-13
- CVE-2026-35616: Fortinet FortiClientEMS Pre-Authentication API Bypass Leading to Remote Code Execution (CISA KEV) — CRITICAL · 2026-04-06
Sources
Enriched from CVE.org, FIRST EPSS, CISA KEV, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on .