FortiClient EMS CVE-2023-48788: SQL Injection to RCE (KEV)

What to do

1. Inventory every FortiClient EMS server and record its version.
2. Upgrade 7.0.x to 7.0.11 or later and 7.2.x to 7.2.3 or later; on 7.4, run 7.4.7 or later or apply Fortinet's hotfix.
3. Limit internet exposure to the ports managed endpoints actually need, and block everything else at the firewall.
4. If a vulnerable server was reachable before you patched, hunt for xp_cmdshell use and remote access tools, and rebuild it if you find them.
5. After any compromise, reset credentials used on or cached by the EMS host, since attackers ran Mimikatz and password-recovery tools.

How to check if you are affected or compromised

• Search the SQL Server ERRORLOG files for the FCEMS instance for xp_cmdshell being enabled or used.
• Look for sqlservr.exe spawning cmd.exe or powershell.exe, and for certutil, curl or msiexec downloading or installing software on the EMS server.
• Check for unexpected ScreenConnect or AnyDesk services and for files such as C:\update.exe, netscan.exe, netpass64.exe or mimikatz.exe.
• Search firewall and proxy logs for 185.56.83.82, 141.136.43.188, 45.141.84.45, ursketz[.]com and unfamiliar *.screenconnect.com subdomains.

What happened#

On March 12, 2024, Fortinet published FG-IR-24-007, a critical SQL injection in the DAS component of FortiClient EMS, the Windows server that manages FortiClient endpoints. An unauthenticated attacker can run code or commands with crafted packets, per the CVE record. Fortinet scores it CVSS 3.1 9.8, as does NVD. Fortinet credits its own EMS team and the UK NCSC, and its advisory now says the bug "is exploited in the wild."

Horizon3.ai's deep dive on March 21 showed how it works. The FcmDaemon.exe service listens on port 8013 for client connections. A crafted FCTUID value in its messages reaches Microsoft SQL Server, where the built-in xp_cmdshell turns injection into command execution. CISA's KEV entry, added March 25, 2024, says the commands run as SYSTEM and marks known ransomware use.

Attacks started fast and kept going. Forescout traced a campaign it calls Connect:fun against a media company. From March 21, the attacker tried to enable xp_cmdshell, then used certutil and msiexec to install ScreenConnect and dropped a Powerfun-based script. In October 2024, Kaspersky found a still-unpatched EMS 7.0.1 server that had been hit the same way. sqlservr.exe started cmd.exe and PowerShell, which fetched ScreenConnect. The attackers then added AnyDesk, Mimikatz, netscan and password-recovery tools. The Hacker News lists targets in a dozen countries, including Brazil, France, India and Spain.

Who is affected#

FortiClient EMS 7.0.1 through 7.0.10 and 7.2.0 through 7.2.2. Fixes are in 7.0.11 and 7.2.3. EMS 6.4 is not affected. Fortinet says it patched production FortiSASE on March 5, 2024. EMS servers are often reachable from the internet so roaming laptops can check in, which is what made them targets.

Do you really need to act?#

Most EMS servers were upgraded in 2024, so the verdict is check exposure. Kaspersky's case shows why it still matters. That server was breached about seven months after the fix. An EMS server pushes policy to every managed endpoint, and Kaspersky's attackers used it as a base for credential theft and lateral movement. Newer bugs matter too. On the 7.4 line, CVE-2026-21643 (7.4.4) and CVE-2026-35616 (7.4.5 and 7.4.6) are both exploited unauthenticated flaws that CISA added to KEV in April 2026.

What to do now#

1. Record each server's version, for example with Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*EMS*' | Select DisplayName, DisplayVersion.
2. Upgrade 7.0.x to 7.0.11 or later and 7.2.x to 7.2.3 or later. On 7.4, run 7.4.7 or later, or apply Fortinet's hotfix.
3. Expose only the ports managed endpoints need, as Kaspersky advises, and block the rest.
4. If a vulnerable server was reachable before patching, run the checks below. Rebuild it if anything turns up, and reset credentials used on that host.

How to tell if you were hit#

• Search SQL Server logs: Select-String -Path 'C:\Program Files\Microsoft SQL Server\MSSQL14.FCEMS\MSSQL\Log\ERRORLOG*' -Pattern 'xp_cmdshell'. Kaspersky found the injection there. Also review the EMS logs folder.
• Look for sqlservr.exe spawning cmd.exe or powershell.exe, and for certutil, curl or msiexec pulling software onto the server.
• Check for ScreenConnect or AnyDesk services you did not install, and for C:\update.exe, netscan.exe, netpass64.exe or mimikatz.exe.
• Search network logs for 185.56.83.82, 141.136.43.188, 45.141.84.45, ursketz[.]com and unfamiliar *.screenconnect.com subdomains.

Timeline#

• Mar 5, 2024 — Fortinet patches production FortiSASE.
• Mar 12, 2024 — Fortinet publishes FG-IR-24-007 with 7.0.11 and 7.2.3.
• Mar 21, 2024 — Horizon3 publishes its analysis. Forescout's victim sees the first attempts.
• Mar 25, 2024 — CISA adds the CVE to KEV.
• Apr 11, 2024 — Forescout publishes Connect:fun.
• Dec 19, 2024 — Kaspersky reports the October 2024 intrusion.
• Apr 13, 2026 — CVE-2026-21643, a second EMS SQL injection, joins KEV.

Vulnerability records

• CVE-2023-48788 · KEV 2024-03-25 · A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Fortinet PSIRT — FG-IR-24-007: Pervasive SQL injection in DAS component fortiguard.com
2. CVE record — CVE-2023-48788 cve.org
3. NVD — CVE-2023-48788 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2023-48788 cisa.gov
5. Fortinet PSIRT — FG-IR-25-1142: SQLi in administrative interface (CVE-2026-21643) fortiguard.fortinet.com
6. Fortinet PSIRT — FG-IR-26-099: API authentication and authorization bypass (CVE-2026-35616) fortiguard.fortinet.com
7. Horizon3.ai — CVE-2023-48788: Fortinet FortiClientEMS SQL Injection Deep Dive horizon3.ai
8. Forescout Vedere Labs — Connect:fun: New exploit campaign in the wild targets media company forescout.com
9. Kaspersky Securelist — Patched FortiClient EMS vulnerability exploited in the wild securelist.com

Coverage and analysis

1. The Hacker News — Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools thehackernews.com