High

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent security advisory after adding a critical vulnerability affecting Fortinet FortiClient EMS to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms that attackers are actively exploiting the flaw in real-world environments. The vulnerability, tracked as CVE-2026-21643, is a severe SQL injection issue that poses an immediate threat to organizations using Fortinet’s centralized endpoint management platform, which is widely deployed in enterprise environments.

CVE-2026-21643 is caused by improper neutralization of special elements in SQL commands (CWE-89), allowing attackers to manipulate backend database queries. Exploitation occurs through specially crafted HTTP requests sent to vulnerable servers, requiring no authentication or prior access. This makes the flaw especially dangerous, as attackers can directly interact with the system remotely without needing valid credentials. Since FortiClient EMS manages security policies across endpoint devices, successful exploitation can provide attackers with control over enterprise-wide security configurations and sensitive infrastructure data.

Once exploited, the vulnerability can allow threat actors to execute unauthorized database commands, alter system configurations, extract sensitive information, or deploy malicious payloads across connected endpoints. Although CISA has not confirmed any specific ransomware association, such unauthenticated remote code execution-style vulnerabilities are commonly leveraged by initial access brokers for large-scale intrusions. The potential impact includes full database compromise, lateral movement within networks, and rapid deployment of secondary malware, making it a high-risk entry point for cyberattacks.

Due to the active exploitation, CISA has mandated a strict mitigation timeline, requiring federal agencies to address CVE-2026-21643 by April 16, 2026. Security teams are strongly urged to apply the latest patches released by Fortinet immediately and align with the same rapid response window in the private sector. Additional recommendations include monitoring for suspicious HTTP traffic targeting EMS systems, implementing secure cloud hosting practices where applicable, and isolating vulnerable systems if patching cannot be performed immediately.