PerimeterClock

Patch-to-exploitation timelines for edge appliances (Fortinet, SonicWall, Ivanti), with detection rules.

CVE-2026-21643: Fortinet FortiClient EMS SQL Injection Vulnerability

Vendor: Fortinet
Product: FortiClient EMS
EPSS: 0.977 (99.9th percentile, 2026-10-30)

Summary

FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 2026-04-13.

Automated summary, checked against CISA and vendor descriptions; not yet reviewed by an analyst.

Timeline

Date Event Source
2026-04-13 Added to CISA KEV (confirmed exploitation) CISA KEV

References

Affected and fixed versions: see the vendor advisory or NVD entry below.