---
id: CVE-2026-39809
title: >-
  A improper neutralization of special elements used in an sql command ('sql
  injection') vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4,
  FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.12, FortiClientEMS
  7.2.0 through …
summary: >-
  A improper neutralization of special elements used in an sql command ('sql
  injection') vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4,
  FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.12, FortiClientEMS
  7.2.0 through …
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-89
vendor: Fortinet
product: FortiClientEMS
affected:
  - FortiClientEMS >= 7.4.3 <= 7.4.4
  - FortiClientEMS >= 7.4.0 <= 7.4.1
  - FortiClientEMS 7.2.12
  - FortiClientEMS >= 7.2.0 <= 7.2.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-14T00:00:00+00:00'
published: '2026-04-14'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:42:15.209Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-39809'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-102'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-102'
tags:
  - cve.org
epss: 0.00133
epssPercentile: 0.02842
ingestedAt: '2026-11-06T15:54:03.970Z'
---

## Overview

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.12, FortiClientEMS 7.2.0 through 7.2.10 may allow attacker to execute unauthorized code or commands via sending crafted requests

## Affected

- `FortiClientEMS >= 7.4.3 <= 7.4.4`
- `FortiClientEMS >= 7.4.0 <= 7.4.1`
- `FortiClientEMS 7.2.12`
- `FortiClientEMS >= 7.2.0 <= 7.2.10`

## Remediation

Upgrade to FortiClientEMS version 7.4.6 or above
Upgrade to FortiClientEMS version 7.4.5 or above
Upgrade to FortiClientEMS version 7.2.13 or above