Malicious code can slip through FortiClient EMS vulnerability
An important update closes a critical security vulnerability in FortiClient Endpoint Management Server (EMS).
(Image: Artur Szczybylo / Shutterstock.com)
Admins managing computers in companies with FortiClient Endpoint Management Server (EMS) should update the application promptly for security reasons. A vulnerability in a specific version can allow malicious code onto systems.
The Vulnerability
In a security advisory, the developers point out that only FortiClient EMS 7.4.4 is affected by the “critical” security vulnerability (CVE-2026-21643). Versions 7.2 and 8.0 are not impacted by the vulnerability. The developers assure that the security issue has been resolved starting with version 7.4.5.
Because SQL commands are not sufficiently sanitized, attackers can exploit the vulnerability with crafted HTTP requests without authentication and execute their code. Due to the severity of the vulnerability, it is assumed that PCs will be fully compromised afterward. So far, FortiGuard has no indications of ongoing attacks. It remains unclear how admins can identify already attacked PCs.
(des)
