CVE-2026-39810
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
FortiClientEMS versions 7.4.0 through 7.4.5 contain a hard-coded cryptographic key. An attacker can use this key to decrypt a database dump and disclose information.
Risk Assessment
Exposure of database contents may lead to leakage of sensitive information and bypass of data protection controls.
Recommendation
Upgrade FortiClientEMS to a version later than 7.4.5 and assess whether any database dumps have been leaked.
Other vulnerabilities in FortiClientEMS
See all- CVE-2025-59922High
An SQL Injection vulnerability in Fortinet FortiClientEMS allows an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP/HTTPS requests.
- CVE-2026-35616CriticalActively exploited
An improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
- CVE-2023-47534Critical
An improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiClientEMS across multiple versions. It allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2026-59836High
A vulnerability in Fortinet FortiClientEMS allows an attacker to disclose information due to improper certificate validation. Affected versions include 7.4.3-7.4.5, 7.4.0-7.4.1, and all 7.2 versions.
- CVE-2023-45581High
An improper privilege management vulnerability (CWE-269) in Fortinet FortiClientEMS allows a site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.
Original NVD description (English source)
A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via decrypting database dump.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS