InfoSecBulletin Cybersecurity for mankind
Threat intelligence company Defused said attackers are now actively exploiting a critical vulnerability in Fortinet’s FortiClient EMS platform. This SQL injection flaw, known as CVE-2026-21643, lets attackers run any code on systems that aren’t fixed. They can do this with simple attacks aimed at the FortiClient EMS web interface using harmful HTTP requests.
“Fortinet Forticlient EMS CVE-2026-21643 – currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists – has seen first exploitation already 4 days ago according to our data,” Defused warned over the weekend.
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
Hackers Exploiting MikroTik RouterOS Flaw Gaining Network Access
CrowdStrike launches SafeMind, the first agentic cybersecurity solution for defenders
Claude, DeepSeek, and Qwen AI agents combinedly used to hit gov.t across Asia
India: C-DOT Launches 14 Local Quantum-Safe Technologies
14,000 Dahua cameras compromised: TP-Link flaws enable RCE
Microsoft Reveals Project Zenith Windows PCs Able to Run 30B+ AI Models Locally
Google issues warning of new Chrome zero-day flaw exploited
“Attackers can smuggle SQL statements through the ‘Site’-header inside an HTTP request. According to Shodan, close to 1000 instances of Forticlient EMS are publicly exposed.”
The flaw was found by Gwendal Guégniaud from Fortinet’s Product Security team. It affects FortiClient EMS version 7.4.4. To fix it, users need to upgrade to version 7.4.5 or a later version.
BleepingComputer reported, Fortinet has yet to update its security advisory and flag the vulnerability as exploited in the wild.
Shadowserver, a group that watches internet security, is tracking more than 2,000 FortiClient EMS versions that have their web interfaces visible online. Over 1,400 of these are in the United States and Europe.
A different Shodan search shows more than just FortiClient EMS. Most of the exposed cases are in the United States. Fortinet recently mitigated zero-day attacks from CVE-2026-24858 by blocking FortiCloud SSO links from running vulnerable firmware versions.
Hackers are using a critical flaw, identified as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway systems to get confidential information.
Citrix first reported CVE-2026-3055 in a security notice on March 23. This announcement also mentioned a serious race condition issue called CVE-2026-4368. The problem affects versions of both products that are before 14.1-60.58, versions older than 13.1-62.23, and those older than 13.1-37.262.
The vendor underlined that the flaw only affected appliances configured as a SAML identity provider (IDP) and noted that action is required only for administrators running on-premise appliances.
As of March 28, The ShadowServer Foundation finds 29,000 NetScaler and 2,250 Gateway instances online. It is not clear how many of these might be weak to CVE-2026-3055.
