CVE-2026-21643

CriticalKnown Exploited

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may…

fortinet·CWE-89·Published 2026-02-06

CVSS

9.1

EPSS

0.94

KEV

Yes

Exploits

cve.orgen

253 chars

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

NVDen

253 chars

NVDes

294 chars

Una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL ('inyección SQL') en Fortinet FortiClientEMS 7.4.4 podría permitir a un atacante no autenticado ejecutar código o comandos no autorizados a través de solicitudes HTTP específicamente diseñadas.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.1	Primary	cve.org	9.1	—	—	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
3.1	Secondary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H