CVE-2026-39809 MEDIUM

CVE-2026-39809

Vendor Fortinet

Product FortiClientEMS

Weakness CWE-89 · SQLi

Published April 14, 2026

Last update April 15, 2026

View on NVD All CVEs

CVSS base score

6.2/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

What the vulnerability does

01Description

A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2.0 through 7.2.12, FortiClientEMS 7.0 all versions may allow attacker to execute unauthorized code or commands via sending crafted requests

Key dates

02Disclosure timeline

April 14, 2026 CVE published

April 15, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-39809 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

Identifiers

CVE CVE-2026-39809

CWE CWE-89

CVSS 6.2 / MEDIUM

Affected versions

Vendor Fortinet

Product FortiClientEMS

Affected ≥ 7.4.3 and ≤ 7.4.4

Vendor Fortinet

Product FortiClientEMS

Affected ≥ 7.4.0 and ≤ 7.4.1

CVE-2026-39809

01Description

02Disclosure timeline

03References

04Related CVE