Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request with SQL injection payload
-
DeliveryBypass input validation in query parser
-
ExploitExecute arbitrary SQL commands
-
ExecutionExtract sensitive data or modify database
-
ImpactAchieve remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against FortiClientEMS 7.4.4 default configurations. Vulnerable endpoint accepts HTTP requests without authentication or input sanitization on SQL query parameters. |
| Impact | CVSS 9.8 — standard unauthenticated SQL injection. |
| Exploit ScenarioDerived | An attacker injects SQL commands to extract database contents. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized SQL commands.
Earlier versions of this analysis (1)
SQL injection enables unauthenticated database compromise.
RemediationAI
Apply vendor patches. Use parameterized queries.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89 SQL injection through unsanitized input parameters.
Know when Fortinet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Executive ViewAI
A critical SQL injection vulnerability in FortiClientEMS 7.4.4 allows unauthenticated attackers to execute arbitrary code without authentication or user interaction. This poses immediate risk to organizations using this endpoint management platform, potentially compromising all managed devices and sensitive corporate data at scale.
Until patch availability: (1) Restrict network access to FortiClientEMS console via firewall rules and VPN-only connectivity; (2) Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP requests; (3) Disable remote/external access to FortiClientEMS if not business-critical; (4) Implement strict input validation and rate limiting on FortiClientEMS endpoints; (5) Enable enhanced logging and real-time monitoring for suspicious database queries and HTTP requests; (6) Consider running FortiClientEMS behind a reverse proxy with SQL injection protection. Monitor vendor security advisories daily for patch release.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 an
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, versi
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
FortiOS SSL-VPN contains an improper authentication vulnerability that allows users to bypass two-factor authentication
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet a
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
Unauthenticated path traversal in Fortinet FortiMail (7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6 and 8.0.0-8.0.1) lets a remo
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauth
Exploit-DB