CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Enables Unauthenticated RCE — Actively Exploited in the Wild — Threadlinqs Intelligence
As of 2026-05-30, CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Enables Unauthenticated RCE — Actively Exploited in the Wild is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0380 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: N/A · FINANCIAL
CVE-2026-21643 is a critical (CVSS 9.8) SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) that allows unauthenticated attackers to execute arbitrary SQL commands
OVERVIEW
CVE-2026-21643 is a pre-authentication SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) — the centralized management platform used by enterprises to deploy, configure, and monitor FortiClient endpoint agents (VPN, ZTNA, EPP, telemetry). The flaw exists in the FCTDas (FortiClient Telemetry Data Aggregation Service) component, which exposes a TCP listener on port 8013 used by endpoint agents to submit telemetry. Untrusted user-controllable parameters in endpoint check-in messages are concatenated into dynamic SQL statements executed against the backing Microsoft SQL Server database without parameterization or adequate sanitization.
ROOT CAUSE
The vulnerable code path handles FCTDas inbound messages and constructs T-SQL queries by string concatenation. Because the FCTDas service runs with elevated database privileges and the MSSQL instance shipped with EMS is configured with xp_cmdshell enabled by default, a crafted injection payload can stack a second statement that invokes xp_cmdshell, executing arbitrary OS commands under the MSSQL service account — by default the same high-privileged Windows account used by the EMS installation (commonly NT AUTHORITY\SYSTEM or a dedicated service principal with local administrator rights).
ATTACK CHAIN
1. Reconnaissance — Attacker identifies exposed FortiClient EMS servers via Shodan/Censys fingerprints on TCP/8013, TCP/443 (web UI), and the FCTDas banner.
2. Initial exploitation — Attacker sends a crafted telemetry payload to TCP/8013 containing a SQL injection in a parameter such as the endpoint FCTUID or hostname field. The payload uses T-SQL stacked queries with EXEC master..xp_cmdshell to run OS commands.
3. Code execution — xp_cmdshell returns the result of the OS command. Attackers typically stage a PowerShell or certutil download cradle to fetch a follow-on payload (Cobalt Strike stager, SystemBC, Remcos, or a custom loader).
4. Persistence — Scheduled tasks, new local admin accounts, or WMI event subscriptions. In observed incidents, attackers installed AnyDesk or ScreenConnect for hands-on-keyboard access.
5. Lateral movement — Because EMS often holds domain-joined service accounts and Windows credentials for endpoint management, attackers have stolen LSASS credentials (Mimikatz, comsvcs.dll) and pivoted to Active Directory.
6. Impact — In confirmed incidents, intrusions have culminated in data exfiltration, ransomware deployment (Akira, BlackSuit in observed cases), and destructive wiper activity against backup infrastructure.
AFFECTED VERSIONS
Fortinet PSIRT FG-IR-26-007 identifies the following impacted builds:
- FortiClient EMS 7.4.0 through 7.4.2 — fixed in 7.4.3
- FortiClient EMS 7.2.0 through 7.2.6 — fixed in 7.2.7
- FortiClient EMS 7.0.1 through 7.0.12 — fixed in 7.0.13
- FortiClient EMS 6.x — end of life, no patch; upgrade required
IN-THE-WILD EXPLOITATION
Horizon3.ai and Mandiant independently reported exploitation observed in early April 2026, with the earliest confirmed intrusion on 2026-04-03 against a North American managed service provider. Payloads observed include Cobalt Strike (default HTTPS profile on ports 443/8443), SystemBC proxy malware, and the Remcos RAT. Attribution remains provisional; tooling overlaps with financially motivated actors tracked as UNC4841 and the Akira ransomware affiliate ecosystem.
DEFENDER GUIDANCE
The primary remediation is Fortinet patch application. Compensating controls include: (1) blocking inbound TCP/8013 at the network perimeter and allowing only from managed endpoint subnets, (2) placing EMS behind a reverse proxy or VPN gateway, (3) disabling xp_cmdshell on the MSSQL instance if not required, (4) enforcing least-privileged service account for MSSQL, (5) enabling verbose MSSQL audit logging, (6) deploying the detections authored by the Threadlinqs Detection Team for Splunk, Microsoft Sentinel, Sigma, and CrowdStrike CQL.
Weaknesses (CWE)
CWE-89, CWE-20, CWE-78
Target sectors: government, financial, healthcare, managed-service-providers, manufacturing, education, energy
Target regions: North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-21643, T1595, T1592, T1583, T1588, T1190, T1133, T1059, T1059, T1047, T1053