InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts at Bishop Fox have unveiled an in-depth look at a critical vulnerability in FortiClient EMS, which is Fortinet’s central tool for managing endpoint security. This issue lets an attacker who is not logged in run any SQL commands, which could completely take over the management server and its connected devices.
The vulnerability, tracked as CVE-2026-21643, carries a critical CVSS score of 9.1.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
The security issue started when the middleware and database parts were changed in version 7.4.4. The update aimed to improve the platform’s multi-tenancy features but accidentally allowed unclean user input to get to the main database.
The “Site” HTTP header, used to identify which tenant a request belongs to, is the primary vector for the attack. Because this processing happens before any login check, it creates a “zero-click” exploit scenario.
As the Bishop Fox analysis explains:
“The HTTP header used to identify which tenant a request belongs to is now passed directly into a database query without sanitization, and this happens before any login check“.
One careful HTTP request can start the attack on the PostgreSQL database. When an attacker can run any SQL command, they can access almost every sensitive data in the EMS system.
Successful exploitation grants access to:
Administrator Credentials: Stealing hashes or plain-text credentials for EMS admins.
Endpoint Inventory: Viewing a complete map of all managed devices on the network.
Security Policies: Modifying or disabling the security rules that protect the fleet.
Digital Certificates: Accessing certificates used to authenticate and manage endpoints.
Bishop Fox says that regular error logs might not show everything for groups worried about active abuse. Attackers often use “time-based” injection (using functions like pg_sleep()) to verify the vulnerability without triggering a database error.
“Successful time-based injection via pg_sleep() does not produce a PostgreSQL error and will not appear in the error log under default settings “.
To uncover this activity, researchers suggest temporarily enabling full statement logging (log_statement = ‘all’), though they warn of significant performance overhead.
The flaw affects FortiClient EMS 7.4.4 when multi-tenant mode is on. It seems single-site setups are not affected.
Critical Security Actions:
Patch Immediately: Upgrade to FortiClient EMS 7.4.5 or later. This version replaces vulnerable string interpolation with proper parameterization.
Restrict Web Access: Limit HTTPS access to the EMS web GUI to authorized management networks only.
Disable Multi-Tenancy: If the “Sites” feature is not required, disabling it makes the vulnerable code unreachable.
WAF Protection: Deploy Web Application Firewall rules to strip or validate the “Site” header, specifically blocking SQL keywords and semicolons.
