CyberCVE

CVE-2025-59922

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 throug

Severity
Medium 6.8
CVSS 3.1
Exploited
Not listed
EPSS
0.070
93.5th percentile
Discovered by
Not disclosed
Published
Jan 13, 2026
Assigned by fortinet

Description

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Weakness: CWE-89

Affected products

Vendor Product Category Matched by
Fortinet FortiClient Endpoint / EDR cna-assigner
Vendor-reported affected versions (1)
  • Fortinet · FortiClientEMS

Vendor remediation

Upgrade to FortiClientEMS version 7.4.5 or above Upgrade to FortiClientEMS version 7.2.12 or above

References