CVE-2025-59922
Published: 13 January 2026
Summary
CVE-2025-59922 is a high-severity SQL Injection (CWE-89) vulnerability in Fortinet Forticlientems. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-59922 is an SQL injection vulnerability (CWE-89) affecting Fortinet FortiClientEMS in multiple versions, including 7.4.3 through 7.4.4, 7.4.0 through 7.4.1, 7.2.0 through 7.2.10, and 7.0 all versions. The flaw stems from improper neutralization of special elements used in an SQL command, which may enable execution of unauthorized SQL code or commands. It was published on 2026-01-13 with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
An authenticated attacker with at least read-only admin permissions can exploit this vulnerability over the network with low complexity and no user interaction required. By sending crafted HTTP or HTTPS requests to the affected FortiClientEMS server, the attacker can execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion within the underlying database.
For mitigation details, refer to the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-25-735.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2239
Vulnerability details
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.4, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2.0 through 7.2.10, FortiClientEMS 7.0 all versions may allow an authenticated attacker with…
more
at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in a network-exposed web management application (FortiClientEMS) directly enables remote exploitation of a public-facing app by an authenticated admin via crafted HTTP/S requests.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all inputs to the FortiClientEMS HTTP/HTTPS interface, blocking the crafted SQL payloads that exploit improper neutralization (CWE-89).
Mandates prompt application of vendor patches that remediate the SQL-injection flaw in the listed FortiClientEMS versions.
Restricts the read-only admin role to the minimum privileges needed, reducing the scope of database commands an authenticated attacker can reach even if injection succeeds.