CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Enables Unauthenticated RCE — Actively Exploited in the Wild

CVE-2026-21643 (TL-2026-0380), also tracked as FortiClient EMS FCTDas SQLi, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-04-16. It has no confirmed attribution, affects Fortinet FortiClient Enterprise Management Server (EMS), references 1 CVE (CVE-2026-21643), maps to 24 MITRE ATT&CK techniques (T1003, T1021, T1036), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-0380

Threat ID
TL-2026-0380
Also known as
FortiClient EMS FCTDas SQLi, FG-IR-26-007, FortiStackSQL
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-16
Last reviewed
2026-04-16
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
government, financial, healthcare, managed-service-providers, manufacturing, education, energy
Target regions
North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
29

Malware and tooling in CVE-2026-21643

Malware and tooling: Akira, Cobalt Strike, SystemBC - S9001, black suit, AnyDesk, Cobalt Strike 4.9 default HTTPS malleable profile, Mimikatz, ScreenConnect

CVE-2026-21643 is a critical (CVSS 9.8) SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) that allows unauthenticated attackers to execute arbitrary SQL commands against the underlying Microsoft SQL Server and, through the xp_cmdshell extended stored procedure, achieve remote code execution as NT AUTHORITY\SYSTEM on the EMS host. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-04-15 after multiple incident response engagements confirmed in-the-wild exploitation. Defenders should patch immediately, remove EMS management interfaces from the public internet, and hunt for post-exploitation artifacts including xp_cmdshell abuse, Cobalt Strike beacons, and outbound C2 to attacker-controlled infrastructure.

How CVE-2026-21643 works

OVERVIEW

CVE-2026-21643 is a pre-authentication SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) — the centralized management platform used by enterprises to deploy, configure, and monitor FortiClient endpoint agents (VPN, ZTNA, EPP, telemetry). The flaw exists in the FCTDas (FortiClient Telemetry Data Aggregation Service) component, which exposes a TCP listener on port 8013 used by endpoint agents to submit telemetry. Untrusted user-controllable parameters in endpoint check-in messages are concatenated into dynamic SQL statements executed against the backing Microsoft SQL Server database without parameterization or adequate sanitization.

ROOT CAUSE

The vulnerable code path handles FCTDas inbound messages and constructs T-SQL queries by string concatenation. Because the FCTDas service runs with elevated database privileges and the MSSQL instance shipped with EMS is configured with xp_cmdshell enabled by default, a crafted injection payload can stack a second statement that invokes xp_cmdshell, executing arbitrary OS commands under the MSSQL service account — by default the same high-privileged Windows account used by the EMS installation (commonly NT AUTHORITY\SYSTEM or a dedicated service principal with local administrator rights).

ATTACK CHAIN

1. Reconnaissance — Attacker identifies exposed FortiClient EMS servers via Shodan/Censys fingerprints on TCP/8013, TCP/443 (web UI), and the FCTDas banner. 2. Initial exploitation — Attacker sends a crafted telemetry payload to TCP/8013 containing a SQL injection in a parameter such as the endpoint FCTUID or hostname field. The payload uses T-SQL stacked queries with EXEC master..xp_cmdshell to run OS commands. 3. Code execution — xp_cmdshell returns the result of the OS command. Attackers typically stage a PowerShell or certutil download cradle to fetch a follow-on payload (Cobalt Strike stager, SystemBC, Remcos, or a custom loader). 4. Persistence — Scheduled tasks, new local admin accounts, or WMI event subscriptions. In observed incidents, attackers installed AnyDesk or ScreenConnect for hands-on-keyboard access. 5. Lateral movement — Because EMS often holds domain-joined service accounts and Windows credentials for endpoint management, attackers have stolen LSASS credentials (Mimikatz, comsvcs.dll) and pivoted to Active Directory. 6. Impact — In confirmed incidents, intrusions have culminated in data exfiltration, ransomware deployment (Akira, BlackSuit in observed cases), and destructive wiper activity against backup infrastructure.

AFFECTED VERSIONS

Fortinet PSIRT FG-IR-26-007 identifies the following impacted builds: - FortiClient EMS 7.4.0 through 7.4.2 — fixed in 7.4.3 - FortiClient EMS 7.2.0 through 7.2.6 — fixed in 7.2.7 - FortiClient EMS 7.0.1 through 7.0.12 — fixed in 7.0.13 - FortiClient EMS 6.x — end of life, no patch; upgrade required

IN-THE-WILD EXPLOITATION

Horizon3.ai and Mandiant independently reported exploitation observed in early April 2026, with the earliest confirmed intrusion on 2026-04-03 against a North American managed service provider. Payloads observed include Cobalt Strike (default HTTPS profile on ports 443/8443), SystemBC proxy malware, and the Remcos RAT. Attribution remains provisional; tooling overlaps with financially motivated actors tracked as UNC4841 and the Akira ransomware affiliate ecosystem.

DEFENDER GUIDANCE

The primary remediation is Fortinet patch application. Compensating controls include: (1) blocking inbound TCP/8013 at the network perimeter and allowing only from managed endpoint subnets, (2) placing EMS behind a reverse proxy or VPN gateway, (3) disabling xp_cmdshell on the MSSQL instance if not required, (4) enforcing least-privileged service account for MSSQL, (5) enabling verbose MSSQL audit logging, (6) deploying the detections authored by the Threadlinqs Detection Team for Splunk, Microsoft Sentinel, Sigma, and CrowdStrike CQL.

MITRE ATT&CK techniques used in TL-2026-0380

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter

Persistence

T1053 Scheduled Task/Job; T1136 Create Account; T1505 Server Software Component

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools

Privilege Escalation

T1078 Valid Accounts

Discovery

T1087 Account Discovery; T1482 Domain Trust Discovery

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2026-21643

  • Fortinet — FortiClient Enterprise Management Server (EMS)
    Vulnerable versions: 7.4.0; 7.4.1; 7.4.2; 7.2.0; 7.2.1; 7.2.2; 7.2.3; 7.2.4; 7.2.5; 7.2.6
    Fixed in: 7.4.3; 7.2.7; 7.0.13

Remediation for CVE-2026-21643

Patches

  • FortiClient EMS 7.4.3 (fixes 7.4.0–7.4.2)
  • FortiClient EMS 7.2.7 (fixes 7.2.0–7.2.6)
  • FortiClient EMS 7.0.13 (fixes 7.0.1–7.0.12)
  • FortiClient EMS 6.x: no patch — upgrade to 7.0.13 or later

Immediate actions

  • Apply Fortinet PSIRT FG-IR-26-007 patch: upgrade FortiClient EMS to 7.4.3, 7.2.7, or 7.0.13
  • Block inbound TCP/8013 at perimeter; allow only from trusted managed endpoint subnets
  • Disable xp_cmdshell on the MSSQL instance backing FortiClient EMS if operationally feasible
  • Isolate EMS servers from domain controllers and limit outbound egress to only required Fortinet update endpoints
  • Hunt for IOCs listed in this brief across endpoint, network, and MSSQL audit logs back to 2026-03-20

Workarounds

  • If patching cannot be completed immediately, restrict TCP/8013 to specific management subnets via host firewall
  • Disable FCTDas service temporarily until patch is applied (endpoint telemetry will be interrupted)
  • Remove xp_cmdshell permission from the MSSQL service account

Longer-term hardening

  • Place FortiClient EMS behind a reverse proxy or VPN gateway; never expose to the public internet
  • Run the MSSQL instance under a least-privileged service account, not NT AUTHORITY\SYSTEM
  • Enable MSSQL server-level audit with Extended Events for xp_cmdshell usage and suspicious logins
  • Deploy Threadlinqs detections for xp_cmdshell abuse, Cobalt Strike beacons, and EMS anomalies
  • Segment management networks: EMS, SIEM, and vulnerability scanners on a separate VLAN with ACLs
  • Adopt tiered administration model for domain-joined management servers

CVEs associated with CVE-2026-21643

CVE-2026-21643

Weaknesses (CWE) in CVE-2026-21643

CWE-89, CWE-20, CWE-78

Timeline of CVE-2026-21643

  • Independent researcher privately disclosed the FCTDas SQL injection flaw to Fortinet PSIRT under coordinated disclosure
  • First confirmed in-the-wild intrusion observed by Mandiant DFIR team targeting a North American managed service provider
  • MITRE reserved CVE-2026-21643 for coordinated release
  • Fortinet published PSIRT advisory FG-IR-26-007 and released patched builds 7.4.3, 7.2.7, and 7.0.13
  • Mandiant released threat intelligence flash detailing ransomware deployment post-exploitation (Akira, BlackSuit affiliates)
  • Horizon3.ai published technical analysis and a working proof-of-concept detection harness for authorized testing
  • CISA added CVE-2026-21643 to the Known Exploited Vulnerabilities catalog with federal remediation deadline of 2026-05-06
  • Threadlinqs Intelligence published defender-focused research brief with full MITRE mapping, IOCs, and production SIEM detections
  • As of 2026-05-29, CVE-2026-21643 (FortiClient EMS pre-auth SQLi, CVSS 9.x) remains actively exploited in the wild and sits in CISA KEV, with CrowdSec tracking 51 attacking IPs in late April and no decline or takedown reported. A patch exists (Fortinet 7.4.5) but unpatched EMS hosts stay at live RCE/ransomware risk, so the threat is still active.

Sources cited for CVE-2026-21643

More in vulnerability

Detection coverage for TL-2026-0380

As of 2026-04-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0380 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats