Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 - CVE-2026-21643

CVE

CVE-2026-21643

CVSS

9.8

Published

2026-03-09 00:00

Collected

2026-07-08 00:04

---
id: 3838
title: "Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 - CVE-2026-21643"
cve: CVE-2026-21643
cvss: 9.8
severity: critical
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4"
published_at: "2026-03-09 00:00"
tags: ["vulnerability-research", "sql-injection", "web-security", "pre-auth", "forticlient-ems", "fortinet", "cve-2026-21643", "multi-tenancy"]
phying_url: "https://phying.com/item/3838"
lang: en
---

# Pre-Authentication SQL Injection in FortiClient EMS 7.4.4 - CVE-2026-21643

## Summary

Pre-auth CVE-2026-21643 exploitation: /api/v1/init_consts leaks database errors with no lockout, letting attackers extract admin credentials and endpoint data from multi-tenant FortiClient EMS 7.4.4.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-21643
- **CVSS:** 9.8
- **Published:** 2026-03-09 00:00
- **Original:** https://bishopfox.com/blog/cve-2026-21643-pre-authentication-sql-injection-in-forticlient-ems-7-4-4
- **Phying News:** https://phying.com/item/3838