tldrdailynews.com logo

Active Fortinet SQL Flaw Targets FortiClient EMS, CISA Warns

1 min read
Source: CyberSecurityNews
Active Fortinet SQL Flaw Targets FortiClient EMS, CISA Warns
Photo: CyberSecurityNews
TL;DR

CISA added CVE-2026-21643, a critical unauthenticated SQL injection in Fortinet FortiClient EMS, to the Known Exploited Vulnerabilities (KEV) catalog, signaling active exploitation in the wild. The flaw enables remote code execution without authentication, risking full database compromise on affected FortiClient EMS deployments. Fortinet has released patches; federal agencies must patch by April 16, 2026, and private-sector admins are urged to patch within three days, monitor for unusual HTTP requests targeting EMS, and take the server offline if patching isn’t possible.

Topics:technologycyber-security-news#cisa-kev#cve-2026-21643#cyber-security-news#forticlient-ems#fortinet#sql-injection
Share this article
  1. CISA Warns of Fortinet SQL Injection Vulnerability Actively Exploited in Attacks  CyberSecurityNews
  2. Ancient Excel bug comes out of retirement for active attacks  theregister.com
  3. CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software  The Hacker News
  4. Organizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities  SecurityWeek
  5. U.S. CISA adds Microsoft SharePoint Server, and Microsoft Office Excel flaws to its Known Exploited Vulnerabilities catalog  Security Affairs

Want the full story? Read the original reporting

Read on CyberSecurityNews