InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts at Bishop Fox have unveiled an in-depth look at a critical vulnerability in FortiClient EMS, which is Fortinet’s central tool for managing endpoint security. This issue lets an attacker who is not logged in run any SQL commands, which could completely take over the management server and its connected devices.
The vulnerability, tracked as CVE-2026-21643, carries a critical CVSS score of 9.1.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
The security issue started when the middleware and database parts were changed in version 7.4.4. The update aimed to improve the platform’s multi-tenancy features but accidentally allowed unclean user input to get to the main database.
The “Site” HTTP header, used to identify which tenant a request belongs to, is the primary vector for the attack. Because this processing happens before any login check, it creates a “zero-click” exploit scenario.
As the Bishop Fox analysis explains:
“The HTTP header used to identify which tenant a request belongs to is now passed directly into a database query without sanitization, and this happens before any login check“.
One careful HTTP request can start the attack on the PostgreSQL database. When an attacker can run any SQL command, they can access almost every sensitive data in the EMS system.
Successful exploitation grants access to:
Administrator Credentials: Stealing hashes or plain-text credentials for EMS admins.
Endpoint Inventory: Viewing a complete map of all managed devices on the network.
Security Policies: Modifying or disabling the security rules that protect the fleet.
Digital Certificates: Accessing certificates used to authenticate and manage endpoints.
Bishop Fox says that regular error logs might not show everything for groups worried about active abuse. Attackers often use “time-based” injection (using functions like pg_sleep()) to verify the vulnerability without triggering a database error.
“Successful time-based injection via pg_sleep() does not produce a PostgreSQL error and will not appear in the error log under default settings “.
To uncover this activity, researchers suggest temporarily enabling full statement logging (log_statement = ‘all’), though they warn of significant performance overhead.
The flaw affects FortiClient EMS 7.4.4 when multi-tenant mode is on. It seems single-site setups are not affected.
Critical Security Actions:
Patch Immediately: Upgrade to FortiClient EMS 7.4.5 or later. This version replaces vulnerable string interpolation with proper parameterization.
Restrict Web Access: Limit HTTPS access to the EMS web GUI to authorized management networks only.
Disable Multi-Tenancy: If the “Sites” feature is not required, disabling it makes the vulnerable code unreachable.
WAF Protection: Deploy Web Application Firewall rules to strip or validate the “Site” header, specifically blocking SQL keywords and semicolons.
