InfoSecBulletin Cybersecurity for mankind
Cybersecurity experts at Bishop Fox have unveiled an in-depth look at a critical vulnerability in FortiClient EMS, which is Fortinet’s central tool for managing endpoint security. This issue lets an attacker who is not logged in run any SQL commands, which could completely take over the management server and its connected devices.
The vulnerability, tracked as CVE-2026-21643, carries a critical CVSS score of 9.1.
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
The security issue started when the middleware and database parts were changed in version 7.4.4. The update aimed to improve the platform’s multi-tenancy features but accidentally allowed unclean user input to get to the main database.
The “Site” HTTP header, used to identify which tenant a request belongs to, is the primary vector for the attack. Because this processing happens before any login check, it creates a “zero-click” exploit scenario.
As the Bishop Fox analysis explains:
“The HTTP header used to identify which tenant a request belongs to is now passed directly into a database query without sanitization, and this happens before any login check“.
One careful HTTP request can start the attack on the PostgreSQL database. When an attacker can run any SQL command, they can access almost every sensitive data in the EMS system.
Successful exploitation grants access to:
Administrator Credentials: Stealing hashes or plain-text credentials for EMS admins.
Endpoint Inventory: Viewing a complete map of all managed devices on the network.
Security Policies: Modifying or disabling the security rules that protect the fleet.
Digital Certificates: Accessing certificates used to authenticate and manage endpoints.
Bishop Fox says that regular error logs might not show everything for groups worried about active abuse. Attackers often use “time-based” injection (using functions like pg_sleep()) to verify the vulnerability without triggering a database error.
“Successful time-based injection via pg_sleep() does not produce a PostgreSQL error and will not appear in the error log under default settings “.
To uncover this activity, researchers suggest temporarily enabling full statement logging (log_statement = ‘all’), though they warn of significant performance overhead.
The flaw affects FortiClient EMS 7.4.4 when multi-tenant mode is on. It seems single-site setups are not affected.
Critical Security Actions:
Patch Immediately: Upgrade to FortiClient EMS 7.4.5 or later. This version replaces vulnerable string interpolation with proper parameterization.
Restrict Web Access: Limit HTTPS access to the EMS web GUI to authorized management networks only.
Disable Multi-Tenancy: If the “Sites” feature is not required, disabling it makes the vulnerable code unreachable.
WAF Protection: Deploy Web Application Firewall rules to strip or validate the “Site” header, specifically blocking SQL keywords and semicolons.
