Article Details
Scrape Timestamp (UTC): 2026-02-10 04:44:02.531
Source: https://thehackernews.com/2026/02/fortinet-patches-critical-sqli-flaw.html
Original Article Text
Click to Toggle View
Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution. Fortinet has released security updates to address a critical flaw impacting FortiClientEMS that could lead to the execution of arbitrary code on susceptible systems. The vulnerability, tracked as CVE-2026-21643, has a CVSS rating of 9.1 out of a maximum of 10.0. "An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests," Fortinet said in an advisory. The shortcoming affects the following versions - Gwendal Guégniaud of the Fortinet Product Security team has been credited with discovering and reporting the flaw. While Fortinet makes no mention of the vulnerability being exploited in the wild, it's essential that users move quickly to apply the fixes. The development comes as the company addressed another critical severity flaw in FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb (CVE-2026-24858, CVSS score: 9.4) that allows an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. Fortinet has since acknowledged that the issue has been actively exploited by bad actors to create local admin accounts for persistence, make configuration changes granting VPN access to those accounts, and exfiltrate the firewall configurations.
Daily Brief Summary
Fortinet has issued patches for a critical SQL injection flaw in FortiClientEMS, identified as CVE-2026-21643, with a CVSS score of 9.1, allowing unauthorized code execution.
The vulnerability stems from improper neutralization of special elements in SQL commands, potentially enabling attackers to execute commands via crafted HTTP requests.
Discovered by Gwendal Guégniaud of Fortinet's Product Security team, the flaw has not yet been reported as exploited in the wild, urging prompt user action to apply patches.
Fortinet also addressed another critical flaw in multiple products, including FortiOS and FortiManager, with CVE-2026-24858, which has been actively exploited.
The latter vulnerability allows attackers with FortiCloud accounts to access other devices, create admin accounts, alter configurations, and exfiltrate firewall data.
Organizations are advised to prioritize these updates to mitigate potential unauthorized access and data breaches, ensuring network security and operational integrity.
These developments stress the importance of maintaining up-to-date systems to protect against emerging threats and vulnerabilities.