CVE-2026-21643

CVE-2026-21643 is a critical SQL injection vulnerability in Fortinet FortiClientEMS 7.4.4, enabling an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. Rated 9.8 CVSS Critical, this flaw has a low attack complexity and can be exploited remotely over the network, leading to complete compromise of confidentiality, integrity, and availability. This vulnerability is currently under active exploitation in the wild, as confirmed by numerous community discussions and media reports. Despite the absence of public exploit code on common platforms, its active exploitation and high community attention underscore the immediate threat it poses to affected systems.