Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 - CVE-2026-21643

bishopfox.com | vulnerability | Critical | Actively exploited | CVE-2026-21643 | #vulnerability-research | #sql-injection | #web-security | #pre-auth | #forticlient-ems | #fortinet | #cve-2026-21643 | #multi-tenancy

Summary

Pre-auth CVE-2026-21643 exploitation: /api/v1/init_consts leaks database errors with no lockout, letting attackers extract admin credentials and endpoint data from multi-tenant FortiClient EMS 7.4.4.
CVSS
9.8
Published
Collected

original ↗

Related coverage

  1. CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection (aretiq.ai)
  2. API Authentication Bypass in FortiClient EMS 7.4.5-7.4.6–CVE-2026-35616 (bishopfox.com)
  3. AppFlowy Authenticated SQL Injection (projectblack.io)
  4. CVE-2026-24031 PoC: Dovecot SQL authentication bypass and user enumeration (github.com)
  5. How Two WordPress Core Bugs Chained into Pre-Auth RCE (bugbunny.ai)
  6. Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898 (bishopfox.com)

back