Is CVE-2026-21643 (Fortinet FortiClient EMS SQL Injection) being exploited in the wild?

Yes. CISA added CVE-2026-21643 to its Known Exploited Vulnerabilities catalogue on 13 April 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

How to Confirm the Wild Exploitation Signal for CVE-2026-21643

For this CVE, the first question is not whether the flaw exists, but whether your Fortinet FortiClient EMS deployment is exposed to the vulnerable SQL injection path and reachable from untrusted networks or integrations. Treat CISA’s KEV listing as an operational signal to verify asset ownership, internet exposure, and whether the management plane or HTTP endpoints are still reachable in production.

That verification should be evidence-based: confirm the product is deployed, identify every instance, and determine whether any instance was present on or before the KEV date. If you cannot prove absence, assume exposure until you can demonstrate the version, segmentation, or compensating control state from inventory and configuration records.

The CISA Known Exploited Vulnerabilities Catalog is the authoritative place to check the KEV status and response expectation, while the CVE Program and NIST National Vulnerability Database are the right references for record hygiene and broader vulnerability context.

Why SQL Injection Here Becomes an Exploitation and Access Problem

This is not just a parsing flaw. A SQL injection in an internet-reachable management product can become a direct path to unauthorized code or command execution, which turns a normal web request into administrative reach over the backend system. Because the direct answer states the issue can be triggered through crafted HTTP requests, the real risk is that attacker traffic may look like ordinary application traffic until the payload is interpreted by the backend.

That matters operationally because exploitation can occur before an operator notices any degradation. In cases like this, compromise assessment should not stop at patch status alone. You also need to check for unexpected process creation, new tasks or services, suspicious database activity, and any evidence that the product was used as an initial foothold into adjacent systems.

NHIMG’s SQL Injection Prevention Guide is the most relevant internal reference for the mechanism itself, and the Zero-Day and Exploited Vulnerabilities Guide fits the response pattern when a weakness is already being actively used in the wild.

What to Do When You Cannot Patch Immediately

If patching must wait, reduce the attack surface rather than relying on passive monitoring. Place the EMS interface behind trusted network boundaries, restrict HTTP exposure to the smallest possible admin population, and validate that any temporary controls actually block the vulnerable request path rather than only hiding the service from casual scanning.

For a management product, compensating controls should be practical and reversible. Tighten access to the console, disable unnecessary publishing paths, watch for suspicious requests against the product endpoints, and preserve logs before making changes so you can support later investigation. If the environment hosts multiple Fortinet appliances or adjacent management tools, assume attackers may test for reuse of the same access pattern elsewhere.

The Vulnerability Management Guide is useful for prioritisation, exception handling, and KEV-driven triage, while the FIRST EPSS reference helps teams compare exploit likelihood against other open work when they must sequence remediation.

Risk and Threat Considerations

Active exploitation changes the priority from routine remediation to exposure containment. When an unauthenticated attacker can reach a management product through crafted HTTP requests, the likely failure mode is rapid initial access, followed by code execution or command execution on a trusted system that may already have broad internal visibility.

Failure mechanism: The vulnerable SQL injection path can let attacker-controlled input alter backend query handling, turning a normal request into unauthorized execution or administrative abuse.

Impact: A compromised EMS instance may expose internal systems, credentials, telemetry, or management functions, and it can become a foothold for further lateral movement or data access.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed flaws need prioritised identification and remediation.
Recommendation — Prioritise and verify remediation of the exposed EMS instance.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	Actively exploited software flaws require timely correction and exception handling.
	AU-2 — Audit Events	Investigating exploitation depends on logs that capture suspicious HTTP activity and admin actions.
	AC-6 — Least Privilege	Restricting management access limits blast radius if the flaw is abused.
Recommendation — Track, remediate, and document exceptions for the EMS vulnerability. Ensure EMS and host logs retain evidence for compromise assessment. Limit EMS access paths and admin reach to the minimum required.
OWASP ASVS	V4 — API and Web Service	The flaw is triggered through crafted HTTP requests against a web service surface.
	V8 — Authorization	Successful exploitation can bypass intended access boundaries and execute unauthorized actions.
Recommendation — Review the exposed web-service surface for injection and request handling weaknesses. Validate that privileged EMS actions remain tightly authorized.

Practitioner Guidance

What to prioritise: First confirm whether any FortiClient EMS instance is internet-reachable, has been exposed during the KEV window, or shows signs of abnormal HTTP access. If yes, treat the system as potentially compromised until evidence proves otherwise.

What to verify: Keep proof of exposure assessment, administrative access logs, web request logs, and host-level artefacts that show whether the vulnerable path was exercised. If patching is delayed, document the compensating control that actually blocks the exploit path, not just the intention to do so.

Practitioner takeaway: Once CISA places a flaw in KEV, the question is no longer theoretical; the correct response is to validate exposure, assume possible abuse until disproven, and investigate for compromise in parallel with remediation.