--- title: Pre-Authentication SQL Injection in FortiClient EMS… description: Bishop Fox researchers detail CVE-2026-21643, a pre-authentication SQL injection (CVSS 9.1) in FortiClient EMS 7.4.4's multi-tenant routing. A 7.4.4 middleware... canonical: https://daily.dev/posts/pre-authentication-sql-injection-in-forticlient-ems--wokpcrinf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Pre-Authentication SQL Injection in FortiClient EMS… | daily.dev og:description: Bishop Fox researchers detail CVE-2026-21643, a pre-authentication SQL injection (CVSS 9.1) in FortiClient EMS 7.4.4's multi-tenant routing. A 7.4.4 middleware... og:url: https://daily.dev/posts/pre-authentication-sql-injection-in-forticlient-ems--wokpcrinf og:image: https://api.daily.dev/og/posts/wOKpcrinF.png og:image:alt: Pre-Authentication SQL Injection in FortiClient EMS… og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Pre-Authentication SQL Injection in FortiClient EMS… **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 16 min read · 0 upvotes · 0 comments ## Summary Bishop Fox researchers detail CVE-2026-21643, a pre-authentication SQL injection (CVSS 9.1) in FortiClient EMS 7.4.4's multi-tenant routing. A 7.4.4 middleware refactor introduced format-string interpolation of the unsanitized 'Site' HTTP header into a PostgreSQL SET search_path statement, executed before authentication. The public /api/v1/init_consts endpoint is exploitable without credentials or lockout, leaking PostgreSQL errors for instant data extraction, and can lead to RCE via superuser database privileges in Fortinet's shipped VM image. Fixed in 7.4.5 using psycopg.sql.Identifier() parameterization; mitigations include restricting network access, disabling multitenancy, or WAF filtering. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-21643 and how does it affect FortiClient EMS 7.4.4? CVE-2026-21643 is a pre-authentication SQL injection (CVSS 9.1) in FortiClient EMS 7.4.4's multi-tenant routing. A 7.4.4 middleware refactor embedded the unsanitized HTTP 'Site' header directly into a PostgreSQL SET search_path statement before authentication, letting an unauthenticated attacker execute arbitrary SQL and, on Fortinet's VM image, gain RCE via the superuser postgres account. _Track vulnerabilities like this before they reach production infrastructure via daily.dev._ ### Which versions of FortiClient EMS are affected by the search_path SQL injection and what's the fix? Only FortiClient EMS 7.4.4 is affected; versions 7.2 and 8.0 use different codebases and were never vulnerable. The flaw was introduced during a middleware refactor in 7.4.4 and patched one release later in 7.4.5, which replaced the vulnerable format-string interpolation with psycopg.sql.Identifier() parameterization to properly escape the schema name. _daily.dev helps teams stay on top of which exact versions need patching next._ ### How can attackers exploit the FortiClient EMS init_consts endpoint for SQL injection without authentication? Attackers send a crafted Site header like x'; SELECT pg_sleep(10)-- to the unauthenticated GET /api/v1/init_consts endpoint, which has no rate limiting or lockout and returns raw PostgreSQL errors in HTTP 500 responses. This allows error-based extraction by wrapping queries in CAST expressions, enabling instant single-request data exfiltration instead of slower timing-based blind injection. _Developers hardening auth flows can follow real exploit breakdowns like this on daily.dev._ ## Similar posts on daily.dev - [CVE-2026-21643: Critical SQL Injection in FortiClientEMS](https://daily.dev/posts/cve-2026-21643-critical-sql-injection-in-forticlientems-qxiu6qu9c) · Arctic Wolf · 1 upvotes · 0 comments - [CVE-2026-35616](https://daily.dev/posts/cve-2026-35616-nzsndgx4k) · Arctic Wolf · 0 upvotes · 0 comments - [Drupal: Critical SQL injection flaw now targeted in attacks](https://daily.dev/posts/drupal-critical-sql-injection-flaw-now-targeted-in-attacks-eovujytlt) · BleepingComputer · 0 upvotes · 0 comments - [Drupal admins rushing to patch maximum severity SQL injection vulnerability](https://daily.dev/posts/drupal-admins-rushing-to-patch-maximum-severity-sql-injection-vulnerability-m8ndbi0q2) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#postgresql](https://daily.dev/tags/postgresql), [#vulnerability](https://daily.dev/tags/vulnerability), [#fortinet](https://daily.dev/tags/fortinet) [View this post on daily.dev](https://daily.dev/posts/pre-authentication-sql-injection-in-forticlient-ems--wokpcrinf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Pre-Authentication SQL Injection in FortiClient EMS…","url":"https://daily.dev/posts/pre-authentication-sql-injection-in-forticlient-ems--wokpcrinf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pre-authentication-sql-injection-in-forticlient-ems--wokpcrinf"},"datePublished":"2026-08-23T12:22:24.135Z","dateModified":"2026-08-23T12:47:14.812Z","description":"Bishop Fox researchers detail CVE-2026-21643, a pre-authentication SQL injection (CVSS 9.1) in FortiClient EMS 7.4.4's multi-tenant routing. A 7.4.4 middleware...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/698e0144d4c9a91168c97c94d5969815?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/698e0144d4c9a91168c97c94d5969815?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pre-authentication-sql-injection-in-forticlient-ems--wokpcrinf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,postgresql,vulnerability,fortinet","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Pre-Authentication SQL Injection in FortiClient EMS…"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/pre-authentication-sql-injection-in-forticlient-ems--wokpcrinf#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-21643 and how does it affect FortiClient EMS 7.4.4?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-21643 is a pre-authentication SQL injection (CVSS 9.1) in FortiClient EMS 7.4.4's multi-tenant routing. A 7.4.4 middleware refactor embedded the unsanitized HTTP 'Site' header directly into a PostgreSQL SET search_path statement before authentication, letting an unauthenticated attacker execute arbitrary SQL and, on Fortinet's VM image, gain RCE via the superuser postgres account. Track vulnerabilities like this before they reach production infrastructure via daily.dev."}},{"@type":"Question","name":"Which versions of FortiClient EMS are affected by the search_path SQL injection and what's the fix?","acceptedAnswer":{"@type":"Answer","text":"Only FortiClient EMS 7.4.4 is affected; versions 7.2 and 8.0 use different codebases and were never vulnerable. The flaw was introduced during a middleware refactor in 7.4.4 and patched one release later in 7.4.5, which replaced the vulnerable format-string interpolation with psycopg.sql.Identifier() parameterization to properly escape the schema name. daily.dev helps teams stay on top of which exact versions need patching next."}},{"@type":"Question","name":"How can attackers exploit the FortiClient EMS init_consts endpoint for SQL injection without authentication?","acceptedAnswer":{"@type":"Answer","text":"Attackers send a crafted Site header like x'; SELECT pg_sleep(10)-- to the unauthenticated GET /api/v1/init_consts endpoint, which has no rate limiting or lockout and returns raw PostgreSQL errors in HTTP 500 responses. This allows error-based extraction by wrapping queries in CAST expressions, enabling instant single-request data exfiltration instead of slower timing-based blind injection. Developers hardening auth flows can follow real exploit breakdowns like this on daily.dev."}}]} ```