CVE-2026-39810 Hardcoded credentials in FortiClientEMS

What is CVE-2026-39810?

CVE-2026-39810 is a medium-severity vulnerability in Fortinet FortiClientEMS, published on 14 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via decrypting database dump.

Weakness: CWE-321

Which versions are affected by CVE-2026-39810?

It affects 1 product.

Products include Fortinet Forticlientems.

How do I fix CVE-2026-39810?

No fix has been published for CVE-2026-39810 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-39810 being exploited?

There is no known exploitation of CVE-2026-39810 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiClientEMS

• CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Exploited Critical 9.1
• CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Exploited Critical 9.1
• CVE-2024-23106 Auth bypass in FortiClientEMS High 7.7
• CVE-2025-59922 SQL injection in FortiClientEMS Medium 6.8
• CVE-2026-59836 Security feature bypass in FortiClientEMS Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pgp9-vrph-v4j2.