CVE-2023-48788: FortiClient EMS SQL injection allows unauthenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network reachability, active exploitation in CISA KEV with ransomware use, and near-maximum EPSS probability make this an urgent patch.

What it is

FortiClient Enterprise Management Server (EMS) versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10 fail to neutralize special elements in SQL commands, allowing SQL injection through specially crafted packets. The flaw is remotely reachable without authentication and can lead to execution of unauthorized code or commands, making it a serious risk to exposed management servers.

Impact

An unauthenticated attacker can inject SQL and execute unauthorized code or commands on the EMS server, potentially compromising the management platform and any endpoints it manages.

Attack surface

Reached over the network via specially crafted packets to the EMS service; the CVSS vector shows no privileges required and no user interaction. No further detail on the exact endpoint or protocol is provided in the record.

Exploitation

Listed in CISA KEV with a due date of 2024-04-15 and flagged for known ransomware campaign use, and EPSS 30-day probability is 0.98446 (99.9th percentile), indicating active exploitation.

What to do

• Apply the Fortinet vendor fix per FG-IR-24-007 for the affected FortiClient EMS versions.
• If patching is not immediately possible, restrict network access to the EMS management interface to trusted hosts only.
• Discontinue use of the product if vendor mitigations cannot be applied, as directed by CISA KEV.
• Review EMS server logs and database activity for signs of injected SQL or unexpected command execution.
• Isolate or rebuild any EMS server suspected of compromise before restoring management functions.

Detection

• Monitor EMS server and database logs for SQL syntax errors, unusual query patterns, or injected SQL keywords.
• Alert on unexpected outbound connections or process creation on the EMS host.
• Hunt for anomalous authentication or request patterns against the EMS management interface from untrusted sources.
• Correlate network traffic to EMS with known exploitation attempts or scanning activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.