InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts at Bishop Fox have unveiled an in-depth look at a critical vulnerability in FortiClient EMS, which is Fortinet’s central tool for managing endpoint security. This issue lets an attacker who is not logged in run any SQL commands, which could completely take over the management server and its connected devices.
The vulnerability, tracked as CVE-2026-21643, carries a critical CVSS score of 9.1.
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
The security issue started when the middleware and database parts were changed in version 7.4.4. The update aimed to improve the platform’s multi-tenancy features but accidentally allowed unclean user input to get to the main database.
The “Site” HTTP header, used to identify which tenant a request belongs to, is the primary vector for the attack. Because this processing happens before any login check, it creates a “zero-click” exploit scenario.
As the Bishop Fox analysis explains:
“The HTTP header used to identify which tenant a request belongs to is now passed directly into a database query without sanitization, and this happens before any login check“.
One careful HTTP request can start the attack on the PostgreSQL database. When an attacker can run any SQL command, they can access almost every sensitive data in the EMS system.
Successful exploitation grants access to:
Administrator Credentials: Stealing hashes or plain-text credentials for EMS admins.
Endpoint Inventory: Viewing a complete map of all managed devices on the network.
Security Policies: Modifying or disabling the security rules that protect the fleet.
Digital Certificates: Accessing certificates used to authenticate and manage endpoints.
Bishop Fox says that regular error logs might not show everything for groups worried about active abuse. Attackers often use “time-based” injection (using functions like pg_sleep()) to verify the vulnerability without triggering a database error.
“Successful time-based injection via pg_sleep() does not produce a PostgreSQL error and will not appear in the error log under default settings “.
To uncover this activity, researchers suggest temporarily enabling full statement logging (log_statement = ‘all’), though they warn of significant performance overhead.
The flaw affects FortiClient EMS 7.4.4 when multi-tenant mode is on. It seems single-site setups are not affected.
Critical Security Actions:
Patch Immediately: Upgrade to FortiClient EMS 7.4.5 or later. This version replaces vulnerable string interpolation with proper parameterization.
Restrict Web Access: Limit HTTPS access to the EMS web GUI to authorized management networks only.
Disable Multi-Tenancy: If the “Sites” feature is not required, disabling it makes the vulnerable code unreachable.
WAF Protection: Deploy Web Application Firewall rules to strip or validate the “Site” header, specifically blocking SQL keywords and semicolons.
