InfoSecBulletin Cybersecurity for mankind
Threat intelligence company Defused said attackers are now actively exploiting a critical vulnerability in Fortinet’s FortiClient EMS platform. This SQL injection flaw, known as CVE-2026-21643, lets attackers run any code on systems that aren’t fixed. They can do this with simple attacks aimed at the FortiClient EMS web interface using harmful HTTP requests.
“Fortinet Forticlient EMS CVE-2026-21643 – currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists – has seen first exploitation already 4 days ago according to our data,” Defused warned over the weekend.
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
“Attackers can smuggle SQL statements through the ‘Site’-header inside an HTTP request. According to Shodan, close to 1000 instances of Forticlient EMS are publicly exposed.”
The flaw was found by Gwendal Guégniaud from Fortinet’s Product Security team. It affects FortiClient EMS version 7.4.4. To fix it, users need to upgrade to version 7.4.5 or a later version.
BleepingComputer reported, Fortinet has yet to update its security advisory and flag the vulnerability as exploited in the wild.
Shadowserver, a group that watches internet security, is tracking more than 2,000 FortiClient EMS versions that have their web interfaces visible online. Over 1,400 of these are in the United States and Europe.
A different Shodan search shows more than just FortiClient EMS. Most of the exposed cases are in the United States. Fortinet recently mitigated zero-day attacks from CVE-2026-24858 by blocking FortiCloud SSO links from running vulnerable firmware versions.
Hackers are using a critical flaw, identified as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway systems to get confidential information.
Citrix first reported CVE-2026-3055 in a security notice on March 23. This announcement also mentioned a serious race condition issue called CVE-2026-4368. The problem affects versions of both products that are before 14.1-60.58, versions older than 13.1-62.23, and those older than 13.1-37.262.
The vendor underlined that the flaw only affected appliances configured as a SAML identity provider (IDP) and noted that action is required only for administrators running on-premise appliances.
As of March 28, The ShadowServer Foundation finds 29,000 NetScaler and 2,250 Gateway instances online. It is not clear how many of these might be weak to CVE-2026-3055.
