CVE-2025-59922

High

Published: 13 January 2026

Published

13 January 2026

Modified

14 January 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0007 21.2th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59922 is a high-severity SQL Injection (CWE-89) vulnerability in Fortinet Forticlientems. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

SI-10 Information Input Validation

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in a network-exposed web management application (FortiClientEMS) directly enables remote exploitation of a public-facing app by an authenticated admin via crafted HTTP/S requests.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with…

at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

Deeper analysisAI

CVE-2025-59922 is an SQL injection vulnerability (CWE-89) affecting Fortinet FortiClientEMS in multiple versions, including 7.4.3 through 7.4.4, 7.4.0 through 7.4.1, 7.2.0 through 7.2.10, and 7.0 all versions. The flaw stems from improper neutralization of special elements used in an SQL command, which may enable execution of unauthorized SQL code or commands. It was published on 2026-01-13 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

An authenticated attacker with at least read-only admin permissions can exploit this vulnerability over the network with low complexity and no user interaction required. By sending crafted HTTP or HTTPS requests to the affected FortiClientEMS server, the attacker can execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database.

For mitigation details, refer to the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-735.

Details

CWE(s): CWE-89

Affected Products

fortinet

forticlientems

7.0.0 — 7.2.12 · 7.4.0 — 7.4.5

CVEs Like This One

CVE-2026-21643Same product: Fortinet Forticlientems

CVE-2026-35616Same product: Fortinet Forticlientems

CVE-2024-23106Same product: Fortinet Forticlientems

CVE-2025-61848Same vendor: Fortinet

CVE-2024-54026Same vendor: Fortinet

CVE-2025-49784Same vendor: Fortinet

CVE-2026-39815Same vendor: Fortinet

CVE-2025-25257Same vendor: Fortinet

CVE-2025-52970Same vendor: Fortinet

CVE-2024-35275Same vendor: Fortinet

References

https://fortiguard.fortinet.com/psirt/FG-IR-25-735
Vendor Advisory · psirt@fortinet.com