Defused, a threat intelligence firm, reports active exploitation of a serious security flaw in Fortinet’s FortiClient EMS.

Designated as CVE-2026-21643, the SQL injection issue enables attackers without authentication to remotely execute code or commands on unpatched systems. This is achieved through simple attacks on the web interface (FortiClientEMS GUI) using specially crafted HTTP requests.

Defused cautioned on social media that, though currently listed by CISA and other KEV lists as not exploited, they have seen exploitation of “Fortinet Forticlient EMS CVE-2026-21643” since four days ago.

The firm stated that attackers are injecting SQL commands via the “Site” header in HTTP requests. Shodan indicates nearly 1000 Forticlient EMS instances are publicly accessible.

The flaw, found by Gwendal Guégniaud of Fortinet Product Security, impacts FortiClient EMS 7.4.4 and can be fixed by upgrading to version 7.4.5 or later.

Fortinet hasn’t yet updated its security bulletin to indicate active exploitation. BleepingComputer has contacted Fortinet for confirmation but hasn’t received a response.

Shadowserver, an internet security watchdog, is monitoring over 2,000 FortiClient EMS instances online exposing the web interfaces, with a large number of IP addresses appearing in the United States and Europe.

A separate Shodan search reveals even more FortiClient EMS instances. The U.S. hosts most of the exposed instances.

Fortinet vulnerabilities are frequently targets for gaining access to company networks in ransomware and espionage operations (often as zero-days before patches are available).

Recently, Fortinet took action against CVE-2026-24858 zero-day exploitation by blocking FortiCloud SSO connections from vulnerable firmware versions.

In March 2024, CISA directed federal agencies to patch another FortiClient EMS SQL injection issue that was exploited in ransomware incidents and by Salt Typhoon, a Chinese government-backed hacking group, to infiltrate telecom providers.

CISA lists 24 Fortinet vulnerabilities as actively exploited, including 13 used in ransomware attacks.