CVE-2026-39809

MediumCVSS 6.7/10Last modified Nov 6, 2026

Description

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.12, FortiClientEMS 7.2.0 through 7.2.10 may allow attacker to execute unauthorized code or commands via sending crafted requests

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Fortinet	FortiClientEMS	>= 7.4.3, <= 7.4.4; >= 7.4.0, <= 7.4.1

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-102Vendor Advisory

Timeline

Published: Apr 14, 2026
Last modified: Nov 6, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-39819.8A vulnerability was found in itsourcecode Online Doctor Appointment System 1.0. Affected is an unknown function of the file /admin/doctor_ac CVE-2026-398105.5A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1 may a CVE-2026-398114.9A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all vers CVE-2026-398124.8A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through CVE-2026-398139.8A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attack CVE-2026-398146.7Multiple Relative Path Traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6 CVE-2026-398158.8A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7 CVE-2026-398168.8The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Ap CVE-2026-398175.9The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filena CVE-2026-398195.3The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with ac CVE-2026-39824.3A vulnerability was determined in itsourcecode University Management System 1.0. Affected by this vulnerability is an unknown functionality CVE-2026-398207.5Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocati