Fortinet FortiClientEMS vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 20231
3. 20246
4. 20258
5. 20266

Known exploitedNewest addition to KEV first

• CVE-2026-21643

  An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an…

  Fortinet · FortiClientEMS

  ExploitedCritical9.1
• CVE-2026-35616

  A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or…

  Fortinet · FortiClientEMS

  ExploitedCritical9.1
• CVE-2023-48788

  A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS…

  Fortinet · FortiClientEMS

  ExploitedCritical9.3

Newest CVEs

• CVE-2026-59836

  A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all…

  Fortinet · FortiClientEMS

  Medium6.7
• CVE-2026-39810

  A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1 may allow attacker to…

  Fortinet · FortiClientEMS

  Medium5.2
• CVE-2026-39809

  A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4,…

  Fortinet · FortiClientEMS

  Medium6.2
• CVE-2026-35616

  A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or…

  Fortinet · FortiClientEMS

  ExploitedCritical9.1
• CVE-2026-21643

  An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an…

  Fortinet · FortiClientEMS

  ExploitedCritical9.1
• CVE-2025-59922

  An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3…

  Fortinet · FortiClientEMS

  Medium6.8
• CVE-2023-48786

  A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated…

  Fortinet · FortiClientEMS

  Medium4.1
• CVE-2024-32119

  An improper authentication vulnerability [CWE-287] in Fortinet FortiClientEMS version 7.4.0 and before 7.2.4 allows an unauthenticated attacker with the…

  Fortinet · FortiClientEMS

  Medium4.6
• CVE-2025-22859

  A Relative Path Traversal vulnerability [CWE-23] in FortiClientEMS 7.4.0 through 7.4.1 and FortiClientEMS Cloud 7.4.0 through 7.4.1 may allow a remote…

  Fortinet · FortiClientEMS

  Medium5.0
• CVE-2025-22855

  An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Fortinet FortiClient before 7.4.1 may allow…

  Fortinet · FortiClientEMS

  Low2.6