InfoSecBulletin Cybersecurity for mankind
Threat intelligence company Defused said attackers are now actively exploiting a critical vulnerability in Fortinet’s FortiClient EMS platform. This SQL injection flaw, known as CVE-2026-21643, lets attackers run any code on systems that aren’t fixed. They can do this with simple attacks aimed at the FortiClient EMS web interface using harmful HTTP requests.
“Fortinet Forticlient EMS CVE-2026-21643 – currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists – has seen first exploitation already 4 days ago according to our data,” Defused warned over the weekend.
Brazilian health surveillance platform breach exposes 100K+ sensitive documents
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
“Attackers can smuggle SQL statements through the ‘Site’-header inside an HTTP request. According to Shodan, close to 1000 instances of Forticlient EMS are publicly exposed.”
The flaw was found by Gwendal Guégniaud from Fortinet’s Product Security team. It affects FortiClient EMS version 7.4.4. To fix it, users need to upgrade to version 7.4.5 or a later version.
BleepingComputer reported, Fortinet has yet to update its security advisory and flag the vulnerability as exploited in the wild.
Shadowserver, a group that watches internet security, is tracking more than 2,000 FortiClient EMS versions that have their web interfaces visible online. Over 1,400 of these are in the United States and Europe.
A different Shodan search shows more than just FortiClient EMS. Most of the exposed cases are in the United States. Fortinet recently mitigated zero-day attacks from CVE-2026-24858 by blocking FortiCloud SSO links from running vulnerable firmware versions.
Hackers are using a critical flaw, identified as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway systems to get confidential information.
Citrix first reported CVE-2026-3055 in a security notice on March 23. This announcement also mentioned a serious race condition issue called CVE-2026-4368. The problem affects versions of both products that are before 14.1-60.58, versions older than 13.1-62.23, and those older than 13.1-37.262.
The vendor underlined that the flaw only affected appliances configured as a SAML identity provider (IDP) and noted that action is required only for administrators running on-premise appliances.
As of March 28, The ShadowServer Foundation finds 29,000 NetScaler and 2,250 Gateway instances online. It is not clear how many of these might be weak to CVE-2026-3055.
