FortiClient Hit by Severe SQL Injection Vulnerability Enabling Database Intrusion

Cybersecurity researchers have a detailed a critical security flaw in Fortinet’s FortiClient Enterprise Management Server (EMS).

Tracked as CVE-2026-21643, this severe pre-authentication SQL injection vulnerability carries a near-maximum CVSS severity score of 9.1.

It allows unauthenticated attackers to execute arbitrary SQL commands and gain total control over the underlying database.

The flaw specifically targets multi-tenant deployments of FortiClient EMS version 7.4.4, putting sensitive corporate network data at immediate risk.

The vulnerability stems from a problematic code update. FortiClient EMS serves as a centralized management tool for deploying and monitoring security policies across a company’s endpoints.

During the release of version 7.4.4, Fortinet developers heavily refactored the software’s middleware, which connects web requests to the database.

During this rewrite, they introduced a fatal error regarding how the system handles the HTTP “Site” header, which identifies different tenant environments.

According to Bishop Fox, the flawed code takes the raw header value and feeds it directly into a PostgreSQL database query to set the search path, completely failing to sanitize the input.

Crucially, this connection is established before the system even asks the user for a password.

Because the flaw triggers before authentication, anyone who can reach the EMS web interface over the internet can exploit it.

Attackers only need to send a single, carefully crafted web request to a publicly accessible endpoint, specifically the /api/v1/init_consts path.

This endpoint is highly dangerous because it has no rate-limiting protections and openly returns database error messages directly in the web response.

Using a technique called error-based extraction, attackers can manipulate these error messages to rapidly drain sensitive data from the server, bypassing the need for complex blind attack methods.

The consequences of a successful breach are devastating. By injecting malicious SQL commands, an attacker gains the same system rights as the database administrator.

This level of access enables them to steal administrative passwords, harvest security certificates, and map out the entire inventory of a company’s managed endpoints, including IP addresses and installed software.

Because the database user operates with superuser privileges, hackers can also execute commands directly on the server’s operating system, potentially leading to a complete network takeover.

Fortunately, the scope of this bug is narrow. It only affects FortiClient EMS version 7.4.4 when the multi-tenant “Sites” feature is enabled.

Older versions and the newer 8.0 release use different code architectures and remain unaffected.

Fortinet successfully patched the issue exactly one release later in version 7.4.5 by forcing the software to properly sanitize the incoming HTTP header input.

Security experts urge organizations running the vulnerable 7.4.4 software to upgrade immediately.

To detect potential intrusions, security teams should review Apache access logs for unusually long response times or unexpected HTTP 500 errors on the /api/v1/init_consts endpoint.

For teams unable to patch right away, disabling the multi-tenant feature or strictly limiting web access to the EMS interface can temporarily block attackers from exploiting this critical blind spot.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.