CVE-2026-21643 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical **SQL Injection (SQLi)** flaw in FortiClientEMS. 📉 **Consequences**: Attackers can execute unauthorized code, steal data, or take full control of the system via crafted HTTP requests.

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🐛 **Flaw**: The 'Site' HTTP header is passed directly to PostgreSQL's `search_path` without sanitization.

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: Fortinet. 📦 **Product**: FortiClientEMS. 📅 **Affected Version**: Specifically **v7.4.4** and earlier versions.

Q: What can hackers do? (Privileges/Data)

🕵️ **Privileges**: Unauthenticated access required. 💾 **Data**: Full database manipulation, information disclosure, and potential **OS command execution** via PostgreSQL functions.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🔓 **Auth**: **No authentication** needed. 🌐 **Config**: Exploitable via standard HTTP requests to the `/api/v1/init_consts` endpoint.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp?**: YES. 📜 **PoC**: Available via ProjectDiscovery Nuclei templates. 🌍 **Status**: High risk of automated wild exploitation due to easy PoC availability.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for FortiClientEMS v7.4.4. 📡 **Indicator**: Check if the `/api/v1/init_consts` endpoint is exposed and vulnerable to SQLi via the 'Site' header.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: YES. 📢 **Source**: Fortinet PSIRT (FG-IR-25-1142). 🔄 **Action**: Update to a patched version immediately.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: Block external access to `/api/v1/init_consts`. 🛑 **Mitigation**: Implement WAF rules to sanitize the 'Site' HTTP header and prevent SQL injection patterns.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: **P1**. CVSS Score is **High (9.8+)**. Immediate patching or mitigation is required to prevent total system compromise.

Updated May 06, 2026 CVSS 9.1 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical **SQL Injection (SQLi)** flaw in FortiClientEMS. 📉 **Consequences**: Attackers can execute unauthorized code, steal data, or take full control of the system via crafted HTTP requests.

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-89**: Improper Neutralization of Special Elements used in an SQL Command. 🐛 **Flaw**: The 'Site' HTTP header is passed directly to PostgreSQL's `search_path` without sanitization.

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: Fortinet. 📦 **Product**: FortiClientEMS. 📅 **Affected Version**: Specifically **v7.4.4** and earlier versions.

Q4What can hackers do? (Privileges/Data)

🕵️ **Privileges**: Unauthenticated access required. 💾 **Data**: Full database manipulation, information disclosure, and potential **OS command execution** via PostgreSQL functions.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🔓 **Auth**: **No authentication** needed. 🌐 **Config**: Exploitable via standard HTTP requests to the `/api/v1/init_consts` endpoint.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exp?**: YES. 📜 **PoC**: Available via ProjectDiscovery Nuclei templates. 🌍 **Status**: High risk of automated wild exploitation due to easy PoC availability.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for FortiClientEMS v7.4.4. 📡 **Indicator**: Check if the `/api/v1/init_consts` endpoint is exposed and vulnerable to SQLi via the 'Site' header.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: YES. 📢 **Source**: Fortinet PSIRT (FG-IR-25-1142). 🔄 **Action**: Update to a patched version immediately.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Block external access to `/api/v1/init_consts`. 🛑 **Mitigation**: Implement WAF rules to sanitize the 'Site' HTTP header and prevent SQL injection patterns.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: CRITICAL. 🚨 **Priority**: **P1**. CVSS Score is **High (9.8+)**. Immediate patching or mitigation is required to prevent total system compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) Fortinet CWE-89