A new serious security vulnerability has hit the cybersecurity scene, this time affecting Fortinet 's FortiClient Endpoint Management Server (FortiClient EMS) . The flaw, tracked as CVE-2026-21643 , is rated CVSS 9.1 , underscoring its severity. In practice, it allows unauthorized attackers to execute arbitrary SQL queries and gain access to critical data stored in the system's database, without even requiring a login.
Where the issue is located and which versions are affected
The vulnerability specifically affects FortiClient EMS version 7.4.4 , when multi-tenant mode is enabled . The root of the problem lies in a significant change in the middleware structure , which was introduced in this version to improve connection management and routing between different tenants.
See also: AI vulnerabilities in Amazon Bedrock, LangSmith and SGLang allow RCE
However, during this transition, a critical flaw was introduced: the application directly passes the HTTP Site header into a PostgreSQL search_path query, without any validation or sanitization. This opens the door to SQL injection attacks, allowing attackers to "break" the query structure and insert malicious commands.
Exploitation without authentication and direct access to the database
One of the most concerning features of the vulnerability is that the vulnerable middleware executes before any authentication mechanism. This means that an attacker does not need valid credentials to attempt an attack. All they need to do is send a properly crafted HTTPS request to the server.
Bishop Fox researchers found that the /api/v1/init_consts endpoint is the most efficient entry point. Through this, an attacker can first determine whether multi-tenant mode is enabled and then inject SQL payloads via the Site header.
Why this particular endpoint is so dangerous
This endpoint presents multiple vulnerabilities that make it an ideal target. It does not have request throttling mechanisms (rate limiting), nor protection against brute-force attacks. The most critical, however, is that it returns raw PostgreSQL error messages in the HTTP response.
This allows for very fast data extraction via error-based SQL injection techniques, without the need for slower methods based on response time. In other words, an attacker can extract sensitive information with a minimal number of requests.
See also: Critical vulnerability in Telnetd allows Root RCE via Port 23
From the database to full system control
In case of successful exploitation, the consequences are particularly serious. The EMS database can be completely compromised, while because the database user operates with PostgreSQL superuser privileges, it opens the way forremote code execution on the operating system.
Attackers can steal administrator credentials, extract digital certificates, and gain complete visibility into the managed endpoint fleet. Even more worryingly, they can modify security policies and distribute malicious settings across the network.
Indicators of compromise and what administrators should watch for
Organizations should be on the lookout for specific signs of exploitation, including unusually long response times, which can exceed 5 to 20 seconds, on endpoints such as /api/v1/init_consts and /api/v1/auth/signin.
Additionally, repeated HTTP 500 errors from the same IP address are a strong indication of an attack. PostgreSQL logs can also reveal suspicious commands, especially when they contain characters such as quotes, question marks, or SQL keywords.
FortiClient EMS: Available solutions and immediate protection actions
Fortinet has already addressed the vulnerability with version 7.4.5. Organizations using the vulnerable version are urged to upgrade immediately.
See also: CISA adds Wing FTP vulnerability to KEV list
For those who cannot apply the patch immediately, it is recommended to disable multi-tenant functionality, as well as restrict access to the management interface only to trusted internal networks.
The broader picture and the increasing risks
This vulnerability is part of a growing trend of attacks targeting endpoint management systems and edge infrastructure. These systems are a goldmine for attackers, as they offer centralized control over entire corporate networks.
The incident highlights the need for strict input control, secure middleware design, and continuous monitoring of critical services. In an environment where attacks are becoming increasingly automated, even a small mistake in the code can have disproportionately large consequences.
