InfoSecBulletin Cybersecurity for mankind
Threat intelligence company Defused said attackers are now actively exploiting a critical vulnerability in Fortinet’s FortiClient EMS platform. This SQL injection flaw, known as CVE-2026-21643, lets attackers run any code on systems that aren’t fixed. They can do this with simple attacks aimed at the FortiClient EMS web interface using harmful HTTP requests.
“Fortinet Forticlient EMS CVE-2026-21643 – currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists – has seen first exploitation already 4 days ago according to our data,” Defused warned over the weekend.
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
“Attackers can smuggle SQL statements through the ‘Site’-header inside an HTTP request. According to Shodan, close to 1000 instances of Forticlient EMS are publicly exposed.”
The flaw was found by Gwendal Guégniaud from Fortinet’s Product Security team. It affects FortiClient EMS version 7.4.4. To fix it, users need to upgrade to version 7.4.5 or a later version.
BleepingComputer reported, Fortinet has yet to update its security advisory and flag the vulnerability as exploited in the wild.
Shadowserver, a group that watches internet security, is tracking more than 2,000 FortiClient EMS versions that have their web interfaces visible online. Over 1,400 of these are in the United States and Europe.
A different Shodan search shows more than just FortiClient EMS. Most of the exposed cases are in the United States. Fortinet recently mitigated zero-day attacks from CVE-2026-24858 by blocking FortiCloud SSO links from running vulnerable firmware versions.
Hackers are using a critical flaw, identified as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway systems to get confidential information.
Citrix first reported CVE-2026-3055 in a security notice on March 23. This announcement also mentioned a serious race condition issue called CVE-2026-4368. The problem affects versions of both products that are before 14.1-60.58, versions older than 13.1-62.23, and those older than 13.1-37.262.
The vendor underlined that the flaw only affected appliances configured as a SAML identity provider (IDP) and noted that action is required only for administrators running on-premise appliances.
As of March 28, The ShadowServer Foundation finds 29,000 NetScaler and 2,250 Gateway instances online. It is not clear how many of these might be weak to CVE-2026-3055.
