EUVD-2026-22307Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
AnalysisAI
SQL injection in Fortinet FortiClientEMS 7.0 through 7.4.5 allows high-privileged local attackers to execute unauthorized code or commands with high integrity and confidentiality impact. The vulnerability requires local access and high privileges (PR:H per CVSS vector), making it a risk primarily in environments where administrative users are untrusted or compromised. CISA SSVC framework rates this as non-exploitable via automation due to privilege requirements, though the technical impact is total (confidentiality, integrity, and availability compromise). No public exploit code has been identified at the time of analysis.
Technical ContextAI
The vulnerability resides in Fortinet FortiClientEMS, an endpoint management solution deployed across enterprise environments. The root cause is improper neutralization of special elements in SQL commands (CWE-89), a classic SQL injection flaw that occurs when user-controlled input is concatenated directly into SQL queries without proper parameterization or sanitization. The affected CPE cpe:2.3:a:fortinet:forticlientems indicates the entire product line across versions 7.0 through 7.4.5. SQL injection at the application layer typically occurs in database query construction when the application fails to use prepared statements or bind parameters. Given the CVSS vector showing local attack vector (AV:L) combined with high privilege requirement (PR:H), the attack surface is limited to local administrators or users with elevated privileges on systems running FortiClientEMS.
RemediationAI
Organizations must upgrade FortiClientEMS to a patched version. Fortinet has released security updates addressing this SQL injection vulnerability; consult the official advisory at https://fortiguard.fortinet.com/psirt/FG-IR-26-102 for the specific minimum patched version for your deployment (versions above 7.4.5 and 7.2.12 are expected to include fixes, though exact release versions should be verified from the advisory). In the interim, implement strict local access controls to limit who can interact with FortiClientEMS administrative interfaces, restrict privilege elevation to trusted administrators only, and monitor database query logs for anomalous SQL patterns. Isolate FortiClientEMS management systems on segregated network segments to reduce the attack surface for local attackers with compromised high-privilege credentials.
Fortinet FortiWeb contains a relative path traversal allowing unauthenticated attackers to execute administrative comman
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Fortinet FortiWeb contains an authenticated OS command injection allowing privilege escalation to execute unauthorized c
Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0
Buffer overflow in the Cookie parser in Fortinet FortiOS 4.x before 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9
A product has a SQL injection vulnerability enabling unauthenticated database compromise through improperly neutralized
Remote code execution in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows unauthenticated attackers to execut
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in
Fortinet FortiAnalyzer and FortiManager contain a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.8
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today