CVE-2026-39809
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Fortinet FortiClientEMS versions 7.4.0 through 7.4.5, 7.2.0 through 7.2.12, and 7.0 all versions contain an SQL injection vulnerability (improper neutralization of special elements in SQL commands). An attacker may execute unauthorized code or commands by sending crafted requests.
Risk Assessment
This could lead to unauthorized database access, data leakage, or command execution in the application context, posing a serious threat to confidentiality and integrity.
Recommendation
Update FortiClientEMS to the latest patched version and implement input validation and monitoring for anomalous requests.
Other vulnerabilities in Fortinet FortiClientEMS
See all- CVE-2023-48788CriticalActively exploited
In Fortinet FortiClientEMS versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10, an SQL injection vulnerability exists. Attackers can send specially crafted packets to execute unauthorized code or commands.
- CVE-2024-21753Medium
A path traversal vulnerability in Fortinet FortiClientEMS allows an attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests.
Original NVD description (English source)
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via sending crafted requests
Vulnerability data from NVD (NIST) · CISA KEV · EPSS