{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39809", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "state": "PUBLISHED", "assignerShortName": "fortinet", "dateReserved": "2026-04-07T15:24:05.925Z", "datePublished": "2026-04-14T15:05:56.647Z", "dateUpdated": "2026-11-06T15:42:15.209Z"}, "containers": {"cna": {"affected": [{"vendor": "Fortinet", "product": "FortiClientEMS", "cpes": ["cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "version": "7.4.3", "lessThanOrEqual": "7.4.4", "status": "affected"}, {"versionType": "semver", "version": "7.4.0", "lessThanOrEqual": "7.4.1", "status": "affected"}, {"version": "7.2.12", "status": "affected"}, {"versionType": "semver", "version": "7.2.0", "lessThanOrEqual": "7.2.10", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.12, FortiClientEMS 7.2.0 through 7.2.10 may allow attacker to execute unauthorized code or commands via sending crafted requests"}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-11-06T15:42:15.209Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Execute unauthorized code or commands", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}}], "solutions": [{"lang": "en", "value": "Upgrade to FortiClientEMS version 7.4.6 or above\nUpgrade to FortiClientEMS version 7.4.5 or above\nUpgrade to FortiClientEMS version 7.2.13 or above"}], "references": [{"name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-102", "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-102"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-39809"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T03:58:18.867Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39809", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T15:48:27.620827Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T15:48:35.917Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*"], "vendor": "Fortinet", "product": "FortiClientEMS", "versions": [{"status": "affected", "version": "7.4.3", "versionType": "semver", "lessThanOrEqual": "7.4.4"}, {"status": "affected", "version": "7.4.0", "versionType": "semver", "lessThanOrEqual": "7.4.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to FortiClientEMS version 7.4.6 or above\nUpgrade to FortiClientEMS version 7.4.5 or above\nUpgrade to FortiClientEMS version 7.2.13 or above"}], "references": [{"url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-102", "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-102"}], "descriptions": [{"lang": "en", "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via sending crafted requests"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Execute unauthorized code or commands"}]}], "providerMetadata": {"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "shortName": "fortinet", "dateUpdated": "2026-04-14T17:38:34.503Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39809", "state": "PUBLISHED", "dateUpdated": "2026-04-15T03:58:18.867Z", "dateReserved": "2026-04-07T15:24:05.925Z", "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8", "datePublished": "2026-04-14T15:05:56.647Z", "assignerShortName": "fortinet"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.12:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.10:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.9:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fortinet:forticlientems:7.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "FortiClientEMS", "vendor": "Fortinet", "versions": [{"lessThanOrEqual": "7.4.4", "status": "affected", "version": "7.4.3", "versionType": "semver"}, {"lessThanOrEqual": "7.4.1", "status": "affected", "version": "7.4.0", "versionType": "semver"}, {"status": "affected", "version": "7.2.12"}, {"lessThanOrEqual": "7.2.10", "status": "affected", "version": "7.2.0", "versionType": "semver"}]}], "source": "psirt@fortinet.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*", "matchCriteriaId": "91D4223F-37D4-45D7-A767-2AA8EDAC9AEC", "versionEndIncluding": "7.0.13", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*", "matchCriteriaId": "6829FECD-54D2-42D1-B2F8-B34B3913FC51", "versionEndExcluding": "7.2.13", "versionStartIncluding": "7.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fortinet:forticlientems:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FF067FF-526C-4399-8220-E2978445F005", "versionEndExcluding": "7.4.6", "versionStartIncluding": "7.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.12, FortiClientEMS 7.2.0 through 7.2.10 may allow attacker to execute unauthorized code or commands via sending crafted requests"}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL (\u2019inyecci\u00f3n SQL\u2019) en Fortinet FortiClientEMS 7.4.0 hasta 7.4.5, FortiClientEMS 7.2.0 hasta 7.2.12, FortiClientEMS 7.0 todas las versiones podr\u00eda permitir al atacante ejecutar c\u00f3digo o comandos no autorizados mediante el env\u00edo de solicitudes manipuladas."}], "id": "CVE-2026-39809", "lastModified": "2026-11-06T16:18:15.367", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "psirt@fortinet.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39809", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-04-14T16:16:45.017", "references": [{"source": "psirt@fortinet.com", "tags": ["Vendor Advisory"], "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-102"}], "sourceIdentifier": "psirt@fortinet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@fortinet.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.3,7.4.4]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.4.0,7.4.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "FortiClientEMS", "source": "cna", "vendor": "Fortinet"}, "product": "forticlientems", "vendor": "fortinet"}], "analysis": {"en": {"generated_at": "2026-04-14T20:47:39.951820+00:00", "value": {"mitigation_remediation": ["Check your FortiClientEMS current version.", "If the version is 7.4.0\u20137.4.5, upgrade to 7.4.6 or newer.", "If the version is 7.2.0\u20137.2.12, upgrade to 7.2.13 or newer.", "If using 7.0.x, apply the latest available FortiClientEMS patch."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The flaw affects Fortinet FortiClientEMS products across multiple major releases. Versions 7.4.0 through 7.4.5, 7.2.0 through 7.2.12, and all releases of the 7.0 line are vulnerable. The CPE entries list specific 7.4.x variants up to 7.4.4, confirming these as affected. Administrators should identify whether their infrastructure runs any of these versions.", "description_and_impact": "The vulnerability is an improper neutralization of special elements in SQL commands, enabling a classic SQL injection. Several FortiClientEMS releases, including those in the 7.4.x, 7.2.x, and 7.0 series, contain the flaw. An attacker who can send crafted requests to the affected EMS service may execute arbitrary SQL and potentially run unauthorized code or commands, compromising data integrity, confidentiality, and possibly gaining full system control.", "risk_and_exploitability": "The CVSS base score is 6.2, placing the risk in the medium range, and the EPSS score is not available, making precise exploitation probability hard to assess. The vulnerability is not currently in CISA\u2019s KEV catalog. Given that the flaw requires sending malformed SQL payloads over a network interface, the likely attack vector is remote over the EMS service\u2019s exposed ports. Attackers could invoke the vulnerability without authentication if the EMS is reachable externally, making remediation urgent."}}}}, "created": "2026-04-15T14:41:09.665079+00:00", "title": "SQL Injection in Fortinet FortiClientEMS Enabling Unauthorized Code Execution", "updated": "2026-04-15T15:30:06.830112+00:00", "vendors": ["fortinet", "fortinet$PRODUCT$forticlientems"]}