# CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Enables Unauthenticated RCE — Actively Exploited in the Wild

> CVE-2026-21643 is a critical (CVSS 9.8) SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) that allows unauthenticated attackers to execute arbitrary SQL commands against the underlying Microsoft SQL Server and, through the xp_cmdshell extended stored procedure, achieve remote code execution as NT AUTHORITY\SYSTEM on the EMS host. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-04-15 after multiple incident response engagements confirmed in-the-wild exploitation. Defenders should patch immediately, remove EMS management interfaces from the public internet, and hunt for post-exploitation artifacts including xp_cmdshell abuse, Cobalt Strike beacons, and outbound C2 to attacker-controlled infrastructure.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0380
- **ID:** TL-2026-0380
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21643

## Description

OVERVIEW

CVE-2026-21643 is a pre-authentication SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (EMS) — the centralized management platform used by enterprises to deploy, configure, and monitor FortiClient endpoint agents (VPN, ZTNA, EPP, telemetry). The flaw exists in the FCTDas (FortiClient Telemetry Data Aggregation Service) component, which exposes a TCP listener on port 8013 used by endpoint agents to submit telemetry. Untrusted user-controllable parameters in endpoint check-in messages are concatenated into dynamic SQL statements executed against the backing Microsoft SQL Server database without parameterization or adequate sanitization.

ROOT CAUSE

The vulnerable code path handles FCTDas inbound messages and constructs T-SQL queries by string concatenation. Because the FCTDas service runs with elevated database privileges and the MSSQL instance shipped with EMS is configured with xp_cmdshell enabled by default, a crafted injection payload can stack a second statement that invokes xp_cmdshell, executing arbitrary OS commands under the MSSQL service account — by default the same high-privileged Windows account used by the EMS installation (commonly NT AUTHORITY\SYSTEM or a dedicated service principal with local administrator rights).

ATTACK CHAIN

1. Reconnaissance — Attacker identifies exposed FortiClient EMS servers via Shodan/Censys fingerprints on TCP/8013, TCP/443 (web UI), and the FCTDas banner.
2. Initial exploitation — Attacker sends a crafted telemetry payload to TCP/8013 containing a SQL injection in a parameter such as the endpoint FCTUID or hostname field. The payload uses T-SQL stacked queries with EXEC master..xp_cmdshell to run OS commands.
3. Code execution — xp_cmdshell returns the result of the OS command. Attackers typically stage a PowerShell or certutil download cradle to fetch a follow-on payload (Cobalt Strike stager, SystemBC, Remcos, or a custom loader).
4. Persistence — Scheduled tasks, new local admin accounts, or WMI event subscriptions. In observed incidents, attackers installed AnyDesk or ScreenConnect for hands-on-keyboard access.
5. Lateral movement — Because EMS often holds domain-joined service accounts and Windows credentials for endpoint management, attackers have stolen LSASS credentials (Mimikatz, comsvcs.dll) and pivoted to Active Directory.
6. Impact — In confirmed incidents, intrusions have culminated in data exfiltration, ransomware deployment (Akira, BlackSuit in observed cases), and destructive wiper activity against backup infrastructure.

AFFECTED VERSIONS

Fortinet PSIRT FG-IR-26-007 identifies the following impacted builds:
- FortiClient EMS 7.4.0 through 7.4.2 — fixed in 7.4.3
- FortiClient EMS 7.2.0 through 7.2.6 — fixed in 7.2.7
- FortiClient EMS 7.0.1 through 7.0.12 — fixed in 7.0.13
- FortiClient EMS 6.x — end of life, no patch; upgrade required

IN-THE-WILD EXPLOITATION

Horizon3.ai and Mandiant independently reported exploitation observed in early April 2026, with the earliest confirmed intrusion on 2026-04-03 against a North American managed service provider. Payloads observed include Cobalt Strike (default HTTPS profile on ports 443/8443), SystemBC proxy malware, and the Remcos RAT. Attribution remains provisional; tooling overlaps with financially motivated actors tracked as UNC4841 and the Akira ransomware affiliate ecosystem.

DEFENDER GUIDANCE

The primary remediation is Fortinet patch application. Compensating controls include: (1) blocking inbound TCP/8013 at the network perimeter and allowing only from managed endpoint subnets, (2) placing EMS behind a reverse proxy or VPN gateway, (3) disabling xp_cmdshell on the MSSQL instance if not required, (4) enforcing least-privileged service account for MSSQL, (5) enabling verbose MSSQL audit logging, (6) deploying the detections authored by the Threadlinqs Detection Team for Splunk, Microsoft Sentinel, Sigma, and CrowdStrike CQL.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1053 Scheduled Task/Job
- T1136 Create Account
- T1505 Server Software Component
- T1078 Valid Accounts
- T1070 Indicator Removal
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1482 Domain Trust Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [CISA KEV catalog addition for CVE-2026-21643](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA Cybersecurity Advisory AA26-Fortinet-FortiClient-EMS](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-fortinet-forticlient-ems)
- [Fortinet PSIRT Advisory FG-IR-26-007](https://fortiguard.fortinet.com/psirt/FG-IR-26-007)
- [NVD entry for CVE-2026-21643](https://nvd.nist.gov/vuln/detail/CVE-2026-21643)
- [Horizon3.ai Attack Research: FortiClient EMS CVE-2026-21643 Analysis](https://www.horizon3.ai/attack-research/forticlient-ems-cve-2026-21643)
- [Mandiant Flash: Financially Motivated Exploitation of FortiClient EMS](https://cloud.google.com/blog/topics/threat-intelligence/forticlient-ems-exploitation)
- [Rapid7 Analysis: FortiClient EMS SQL Injection and RCE](https://www.rapid7.com/blog/post/2026/04/15/cve-2026-21643-forticlient-ems)
- [MITRE CWE-89: SQL Injection](https://cwe.mitre.org/data/definitions/89.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0380