InfoSecBulletin Cybersecurity for mankind
Threat intelligence company Defused said attackers are now actively exploiting a critical vulnerability in Fortinet’s FortiClient EMS platform. This SQL injection flaw, known as CVE-2026-21643, lets attackers run any code on systems that aren’t fixed. They can do this with simple attacks aimed at the FortiClient EMS web interface using harmful HTTP requests.
“Fortinet Forticlient EMS CVE-2026-21643 – currently marked as not exploited on CISA and other Known Exploited Vulnerabilities (KEV) lists – has seen first exploitation already 4 days ago according to our data,” Defused warned over the weekend.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
“Attackers can smuggle SQL statements through the ‘Site’-header inside an HTTP request. According to Shodan, close to 1000 instances of Forticlient EMS are publicly exposed.”
The flaw was found by Gwendal Guégniaud from Fortinet’s Product Security team. It affects FortiClient EMS version 7.4.4. To fix it, users need to upgrade to version 7.4.5 or a later version.
BleepingComputer reported, Fortinet has yet to update its security advisory and flag the vulnerability as exploited in the wild.
Shadowserver, a group that watches internet security, is tracking more than 2,000 FortiClient EMS versions that have their web interfaces visible online. Over 1,400 of these are in the United States and Europe.
A different Shodan search shows more than just FortiClient EMS. Most of the exposed cases are in the United States. Fortinet recently mitigated zero-day attacks from CVE-2026-24858 by blocking FortiCloud SSO links from running vulnerable firmware versions.
Hackers are using a critical flaw, identified as CVE-2026-3055, in Citrix NetScaler ADC and NetScaler Gateway systems to get confidential information.
Citrix first reported CVE-2026-3055 in a security notice on March 23. This announcement also mentioned a serious race condition issue called CVE-2026-4368. The problem affects versions of both products that are before 14.1-60.58, versions older than 13.1-62.23, and those older than 13.1-37.262.
The vendor underlined that the flaw only affected appliances configured as a SAML identity provider (IDP) and noted that action is required only for administrators running on-premise appliances.
As of March 28, The ShadowServer Foundation finds 29,000 NetScaler and 2,250 Gateway instances online. It is not clear how many of these might be weak to CVE-2026-3055.
