InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts at Bishop Fox have unveiled an in-depth look at a critical vulnerability in FortiClient EMS, which is Fortinet’s central tool for managing endpoint security. This issue lets an attacker who is not logged in run any SQL commands, which could completely take over the management server and its connected devices.
The vulnerability, tracked as CVE-2026-21643, carries a critical CVSS score of 9.1.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
The security issue started when the middleware and database parts were changed in version 7.4.4. The update aimed to improve the platform’s multi-tenancy features but accidentally allowed unclean user input to get to the main database.
The “Site” HTTP header, used to identify which tenant a request belongs to, is the primary vector for the attack. Because this processing happens before any login check, it creates a “zero-click” exploit scenario.
As the Bishop Fox analysis explains:
“The HTTP header used to identify which tenant a request belongs to is now passed directly into a database query without sanitization, and this happens before any login check“.
One careful HTTP request can start the attack on the PostgreSQL database. When an attacker can run any SQL command, they can access almost every sensitive data in the EMS system.
Successful exploitation grants access to:
Administrator Credentials: Stealing hashes or plain-text credentials for EMS admins.
Endpoint Inventory: Viewing a complete map of all managed devices on the network.
Security Policies: Modifying or disabling the security rules that protect the fleet.
Digital Certificates: Accessing certificates used to authenticate and manage endpoints.
Bishop Fox says that regular error logs might not show everything for groups worried about active abuse. Attackers often use “time-based” injection (using functions like pg_sleep()) to verify the vulnerability without triggering a database error.
“Successful time-based injection via pg_sleep() does not produce a PostgreSQL error and will not appear in the error log under default settings “.
To uncover this activity, researchers suggest temporarily enabling full statement logging (log_statement = ‘all’), though they warn of significant performance overhead.
The flaw affects FortiClient EMS 7.4.4 when multi-tenant mode is on. It seems single-site setups are not affected.
Critical Security Actions:
Patch Immediately: Upgrade to FortiClient EMS 7.4.5 or later. This version replaces vulnerable string interpolation with proper parameterization.
Restrict Web Access: Limit HTTPS access to the EMS web GUI to authorized management networks only.
Disable Multi-Tenancy: If the “Sites” feature is not required, disabling it makes the vulnerable code unreachable.
WAF Protection: Deploy Web Application Firewall rules to strip or validate the “Site” header, specifically blocking SQL keywords and semicolons.
