{"basis":"claimed","id":"CVE-2026-21643","name":"Fortinet FortiClient EMS SQL Injection Vulnerability","vendorProject":"Fortinet","product":"FortiClient EMS","publishedAt":"2026-02-06","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2026-04-13","dueDate":"2026-04-16","ransomware":false},"epss":{"score":0.97735,"percentile":0.99904,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2026-04-15","daysToRule":68},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2026-07-07","daysToRule":151},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.","cwes":["CWE-89"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2026-04-15","firstIsNew":true,"daysToRule":68,"daysAtMost":null,"freePlan":false,"claims":[{"id":"b48e0179ff3f8226d99278c9ef375b88b0e0bb7189b13016cc656667d74cd822","cve_id":"CVE-2026-21643","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"3dd0b2b6f45c4bc08e49bf27ee7be621","rule_name":"FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643","change":"new","default_action":"Block","published_on":"2026-04-15","source_url":"https://developers.cloudflare.com/changelog/post/2026-04-15-waf-release/","source_title":"WAF Release - 2026-04-15","excerpt":"FortiClient EMS - Pre-Auth SQL Injection - CVE:CVE-2026-21643. Previous action: Log. New action: Block. This is a new detection.","first_seen_at":"2026-11-02T21:00:15.584Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2026-07-07","firstIsNew":true,"daysToRule":151,"daysAtMost":null,"freePlan":false,"claims":[{"id":"9cd12dcb08a40b8b8cec3268bce7f41c3364d99d0940d0f8ef8ee86fcf9b969f","cve_id":"CVE-2026-21643","vendor":"f5","product":"Attack signatures","rule_id":"200102208","rule_name":"FortiClient EMS SQL Injection","change":"new","default_action":null,"published_on":"2026-07-07","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200102208 \"FortiClient EMS SQL Injection\" (SQL-Injection, risk High), systems: Other Web Server. References: CVE-2026-21643.","first_seen_at":"2026-11-02T21:00:24.693Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:39.823Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"passed","templateId":"CVE-2026-21643","templatePath":"http/cves/2026/CVE-2026-21643.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/api/v1/init_consts","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/v1/init_consts","status":200,"blocked":false,"rules":[]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"passed","templateId":"CVE-2026-21643","templatePath":"http/cves/2026/CVE-2026-21643.yaml","requests":2,"blockedRequests":0,"rules":[],"note":"","requestDetail":[{"method":"GET","path":"/api/v1/init_consts","status":200,"blocked":false,"rules":[]},{"method":"GET","path":"/api/v1/init_consts","status":200,"blocked":false,"rules":[]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}