CVE-2026-21643Discovered Published
FortiClientEMS 7.4.4: SQL injection (CVE-2026-21643)
Advisory record · Vendor advisory
Status. Two-tier request-filter comparison against Eden 1.103.0 using a synthetic HTTP fixture.
The vulnerability
Fortinet reports that crafted HTTP requests to FortiClientEMS 7.4.4 can trigger SQL injection and unauthorized command execution. Version 7.4.5 fixes the issue in the 7.4 series.
The Eden patch
Tier 1 — declarative policy. Deny all requests under the fixture prefix /api/v2/clients, including benign requests.
Tier 2 — native Rust module. Match /api/v2/clients and refuse requests containing a configured marker in the body.
Measured comparison (2026-11-12 UTC)
| Configuration | Benign request | Attack fixture |
|---|---|---|
| Baseline | HTTP 200 | HTTP 200, backend marker recorded |
| Tier 1 route deny | HTTP 403 | HTTP 403 |
| Tier 2 native module | HTTP 200 | HTTP 403, backend marker absent |
Signed module authority
The module was imported for explicit activation. All expected shards acknowledged activation. Reader inspection, a tampered statement and an invalid signature were rejected. After revocation the same request received HTTP 503. Re-approval and reactivation restored HTTP 403.
Test scope
The fixture scans SQL markers in an HTTP body on the configured client route. The affected vendor handler and SQL query execution remain unverified.
The measurements cover the supplied fixture probes. Alternate routes, encodings, and other bypasses remain untested.