CriticalCISA KEVExploited in the wildPublic exploit

SQL Injection Leading to RCE in Fortinet FortiClient EMS

IdentifiersCVE-2023-48788CWE-89· Improper Neutralization of Special…

CVE-2023-48788 is a critical SQL injection vulnerability in Fortinet FortiClient Enterprise Management Server (FortiClient EMS). It affects FortiClient EMS 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10. According to the provided content, improper neutralization of special elements in SQL commands allows an attacker to send specially crafted packets or requests to the vulnerable EMS server and trigger unauthorized SQL execution. The issue is described as residing in the DB2 Administration Server (DAS) component, and successful exploitation can lead beyond database manipulation to execution of unauthorized code or commands on the underlying server, i.e., remote code execution.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow an unauthenticated attacker to execute unauthorized code or commands on the vulnerable FortiClient EMS server, reportedly with SYSTEM-level privileges. This can provide full compromise of the EMS host, enabling installation of remote access tools, malware deployment, persistence, credential access, lateral movement, privilege escalation within the environment, and use of the server as an initial access foothold for ransomware or other post-compromise operations.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure of FortiClient EMS by removing or restricting public internet access, limiting access to trusted administrative networks, and filtering or blocking untrusted inbound requests to the EMS service. Monitor for exploitation attempts involving crafted requests/packets to EMS, review the host for unauthorized command execution or unexpected remote management software, and perform threat hunting on any internet-exposed instances because the vulnerability has been publicly exploited.

Remediation

Patch, then assume compromise.

Upgrade FortiClient EMS to a fixed release outside the affected ranges. The vulnerable versions identified in the content are 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10; organizations should apply Fortinet’s vendor-provided patches and move to the remediated versions specified by Fortinet for the 7.0 and 7.2 branches. Because the vulnerability is known exploited in the wild, remediation should be prioritized urgently, followed by compromise assessment of exposed or previously unpatched EMS servers.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2023-48788MaturityPoCVerified exploit

This repository contains a proof-of-concept exploit for CVE-2023-48788, a SQL injection vulnerability in Fortinet FortiClient EMS. The main file, CVE-2023-48788.py, is a Python script that connects to a specified FortiClient EMS server over SSL/TCP (default port 8013) and sends a specially crafted registration message containing a SQL injection payload ("' OR 1=1 --"). The script then checks the server's response for the presence of the string 'KA_INTERVAL' to determine if the target is vulnerable. The exploit does not provide post-exploitation capabilities or a shell; it is designed to test for the presence of the vulnerability. The repository also includes a README.md with usage instructions and background information. No hardcoded IPs or domains are present; the target is specified by the user at runtime.

horizon3aiDisclosed Mar 18, 2024pythonnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

FortinetForticlient Enterprise Management Serverapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

35 SOURCESView more in app

secpod blogNews

Jun 22, 2026

INC Ransomware Threat Intelligence Report

A SQL injection vulnerability leading to remote code execution in Fortinet FortiClient EMS.

dark readingNews

Jun 17, 2026

INC Ransomware Thrives by Mastering the Basics

A specific Fortinet EMS vulnerability that the INC ransomware group is described as exploiting as part of its intrusion methods.

acronisNews

Jun 17, 2026

From emerging threat to top-tier ransomware-as-a-service: The evolution of INC ransomware

A vulnerability in Fortinet EMS identified in the report as an initial access vector used by INC ransomware actors.

scworldNews

Mar 31, 2026

Critical Fortinet FortiClient EMS vulnerability under attack | brief | SC Media

A FortiClient EMS SQL injection vulnerability previously added to CISA's Known Exploited Vulnerabilities catalog, indicating confirmed exploitation.

+26 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence7

Every observed campaign linking this CVE to a named adversary.

Associated malware11

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2023-48788

NVD

nvd.nist.gov/vuln/detail/CVE-2023-48788

MITRE CWE · CWE-89

Improper Neutralization of Special Elements…

Vendor Advisory

fortiguard.com/psirt/FG-IR-24-007

US Government Resource

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48788