[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCjch3iAUXrS2nsaoPSlZvZG1p8we42-6ab8MBnQoJm4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":17,"created_at":18,"published_at":19,"article":20,"tags":24,"podcasts":37},"accae9c0-a44c-49b0-8ed8-371d65a085ce","critical-fortinet-forticlient-ems-vulnerability-actively-exploited","7b286a3a-6fc4-4878-85a8-6d4d2e66cf63","Critical Fortinet FortiClient EMS Vulnerability Actively Exploited","Threat actors began exploiting CVE-2026-21643, a critical SQL injection flaw in Fortinet FortiClient EMS, within days of technical details being published in March 2026, despite patches being available since February. The vulnerability allows unauthenticated remote attackers to execute arbitrary code and extract sensitive data including admin credentials and security policies through the \u002Fapi\u002Fv1\u002Finit_consts endpoint. Over 2,000 internet-accessible instances remain vulnerable, demonstrating the critical gap between patch availability and deployment. This incident highlights how quickly attackers can weaponize published vulnerability details against unpatched systems.","**Immediate actions:**\n- Upgrade all FortiClient EMS instances to the latest patched version immediately\n- Identify and inventory all internet-facing Fortinet appliances in your environment\n- Implement temporary network controls to restrict access to vulnerable systems\n\n**Long-term improvements:**\n- Establish automated vulnerability scanning for all network security appliances\n- Create emergency patching procedures with defined timelines for critical vulnerabilities\n- Maintain comprehensive asset inventory with patch status tracking\n\n**Detection measures:**\n- Monitor authentication logs for suspicious admin credential usage\n- Set up alerts for unusual API endpoint access patterns\n- Review network traffic to \u002Fapi\u002Fv1\u002Finit_consts endpoint for unauthorized access",[12,13,14,15,16],"CIS Control 7","NIST SI-2","NIST CM-8","NIST SI-4","ISO 27001 A.12.6.1","published","2026-03-31T12:08:26.650672+00:00","2026-03-31T12:08:26.518+00:00",{"id":7,"url":21,"slug":22,"title":23},"https:\u002F\u002Fwww.securityweek.com\u002Fexploitation-of-critical-fortinet-forticlient-ems-flaw-begins\u002F","exploitation-of-critical-fortinet-forticlient-ems-flaw-begins","Exploitation of Critical Fortinet FortiClient EMS Flaw Begins",[25,31],{"id":26,"name":27,"slug":28,"description":29,"color":30},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":32,"name":33,"slug":34,"description":35,"color":36},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[38],{"id":39,"date":40,"edition":41,"title":42,"audio_url":43},"49ac075d-ca3c-41a5-9724-a9e91bf03b04","2026-03-31","afternoon","ThreatNoir Afternoon Brief — March 31","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-03-31\u002Fthreatnoir-afternoon-brief-2026-03-31.mp3"]