CISA Warns Fortinet SQL Injection Flaw Is Being Actively Exploited

CISA has issued an urgent advisory for CVE-2026-21643, an unauthenticated SQL injection in Fortinet FortiClient EMS that can enable remote code execution; the flaw was added to CISA’s Known Exploited Vulnerabilities list, prompting immediate patching or mitigation (federal BOD 22-01 deadline April 16, 2026) and warnings that organizations should hunt for exploit attempts and follow Fortinet’s vendor guidance.