---
title: "FortiClient EMS CVE-2023-48788: SQL Injection to RCE (KEV)"
url: https://erroneo.us/security/briefs/forticlient-ems-cve-2023-48788-sql-injection-rce/
description: "Unauthenticated SQL injection in FortiClient EMS 7.0.1-7.0.10 and 7.2.0-7.2.2 runs commands via xp_cmdshell; used to plant remote access tools. Check and hunt."
type: security-brief
section: "Security Digest"
date_published: 2024-03-12
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-48788"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiClient EMS CVE-2023-48788: SQL Injection to RCE (KEV)

**Verdict: Check exposure.** Patched since March 2024 and still exploited months later; confirm no EMS server runs 7.0.1 to 7.0.10 or 7.2.0 to 7.2.2, check 7.4 servers against two 2026 KEV bugs, and hunt on any that were exposed before patching.

- **Who must act:** Admins of on-premises FortiClient EMS 7.0.1 to 7.0.10 or 7.2.0 to 7.2.2, especially servers reachable from the internet so roaming endpoints can check in, and 7.4 servers below 7.4.7.
- **Who can relax:** EMS 6.4 users for this bug (not affected), FortiSASE customers (Fortinet patched production FortiSASE on March 5, 2024), and teams on fixed releases that keep EMS off the open internet.
- **Affected:** FortiClient EMS 7.2.0 through 7.2.2; FortiClient EMS 7.0.1 through 7.0.10
- **Fixed:** FortiClient EMS 7.2.3 or above; FortiClient EMS 7.0.11 or above; On the 7.4 line, 7.4.7 or above (or the 7.4.5/7.4.6 hotfix) because of CVE-2026-21643 and CVE-2026-35616
- **CVEs:** CVE-2023-48788
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every FortiClient EMS server and record its version.
2. Upgrade 7.0.x to 7.0.11 or later and 7.2.x to 7.2.3 or later; on 7.4, run 7.4.7 or later or apply Fortinet's hotfix.
3. Limit internet exposure to the ports managed endpoints actually need, and block everything else at the firewall.
4. If a vulnerable server was reachable before you patched, hunt for xp_cmdshell use and remote access tools, and rebuild it if you find them.
5. After any compromise, reset credentials used on or cached by the EMS host, since attackers ran Mimikatz and password-recovery tools.

### How to check if you are affected

- Search the SQL Server ERRORLOG files for the FCEMS instance for xp_cmdshell being enabled or used.
- Look for sqlservr.exe spawning cmd.exe or powershell.exe, and for certutil, curl or msiexec downloading or installing software on the EMS server.
- Check for unexpected ScreenConnect or AnyDesk services and for files such as C:\update.exe, netscan.exe, netpass64.exe or mimikatz.exe.
- Search firewall and proxy logs for 185.56.83.82, 141.136.43.188, 45.141.84.45, ursketz[.]com and unfamiliar *.screenconnect.com subdomains.

## What happened

On March 12, 2024, Fortinet published [FG-IR-24-007](https://www.fortiguard.com/psirt/FG-IR-24-007), a critical SQL injection in the DAS component of FortiClient EMS, the Windows server that manages FortiClient endpoints. An unauthenticated attacker can run code or commands with crafted packets, per the [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-48788). Fortinet scores it CVSS 3.1 9.8, as does [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-48788). Fortinet credits its own EMS team and the UK NCSC, and its advisory now says the bug "is exploited in the wild."

[Horizon3.ai's deep dive](https://www.horizon3.ai/attack-research/attack-blogs/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive/) on March 21 showed how it works. The `FcmDaemon.exe` service listens on port 8013 for client connections. A crafted `FCTUID` value in its messages reaches Microsoft SQL Server, where the built-in `xp_cmdshell` turns injection into command execution. CISA's [KEV entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48788), added March 25, 2024, says the commands run as SYSTEM and marks known ransomware use.

Attacks started fast and kept going. [Forescout](https://www.forescout.com/blog/connectfun-new-exploit-campaign-in-the-wild-targets-media-company/) traced a campaign it calls Connect:fun against a media company. From March 21, the attacker tried to enable `xp_cmdshell`, then used `certutil` and `msiexec` to install ScreenConnect and dropped a Powerfun-based script. In October 2024, [Kaspersky](https://securelist.com/patched-forticlient-ems-vulnerability-exploited-in-the-wild/115046/) found a still-unpatched EMS 7.0.1 server that had been hit the same way. `sqlservr.exe` started `cmd.exe` and PowerShell, which fetched ScreenConnect. The attackers then added AnyDesk, Mimikatz, netscan and password-recovery tools. [The Hacker News](https://thehackernews.com/2024/12/hackers-exploiting-critical-fortinet.html) lists targets in a dozen countries, including Brazil, France, India and Spain.

## Who is affected

FortiClient EMS 7.0.1 through 7.0.10 and 7.2.0 through 7.2.2. Fixes are in 7.0.11 and 7.2.3. EMS 6.4 is not affected. Fortinet says it patched production FortiSASE on March 5, 2024. EMS servers are often reachable from the internet so roaming laptops can check in, which is what made them targets.

## Do you really need to act?

Most EMS servers were upgraded in 2024, so the verdict is check exposure. Kaspersky's case shows why it still matters. That server was breached about seven months after the fix. An EMS server pushes policy to every managed endpoint, and Kaspersky's attackers used it as a base for credential theft and lateral movement. Newer bugs matter too. On the 7.4 line, [CVE-2026-21643](https://fortiguard.fortinet.com/psirt/FG-IR-25-1142) (7.4.4) and [CVE-2026-35616](https://fortiguard.fortinet.com/psirt/FG-IR-26-099) (7.4.5 and 7.4.6) are both exploited unauthenticated flaws that CISA added to KEV in April 2026.

## What to do now

1. Record each server's version, for example with `Get-ItemProperty HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*EMS*' | Select DisplayName, DisplayVersion`.
2. Upgrade 7.0.x to 7.0.11 or later and 7.2.x to 7.2.3 or later. On 7.4, run 7.4.7 or later, or apply Fortinet's hotfix.
3. Expose only the ports managed endpoints need, as Kaspersky advises, and block the rest.
4. If a vulnerable server was reachable before patching, run the checks below. Rebuild it if anything turns up, and reset credentials used on that host.

## How to tell if you were hit

- Search SQL Server logs: `Select-String -Path 'C:\Program Files\Microsoft SQL Server\MSSQL14.FCEMS\MSSQL\Log\ERRORLOG*' -Pattern 'xp_cmdshell'`. Kaspersky found the injection there. Also review the EMS logs folder.
- Look for `sqlservr.exe` spawning `cmd.exe` or `powershell.exe`, and for `certutil`, `curl` or `msiexec` pulling software onto the server.
- Check for ScreenConnect or AnyDesk services you did not install, and for `C:\update.exe`, `netscan.exe`, `netpass64.exe` or `mimikatz.exe`.
- Search network logs for `185.56.83.82`, `141.136.43.188`, `45.141.84.45`, `ursketz[.]com` and unfamiliar `*.screenconnect.com` subdomains.

## Timeline

- Mar 5, 2024 — Fortinet patches production FortiSASE.
- Mar 12, 2024 — Fortinet publishes FG-IR-24-007 with 7.0.11 and 7.2.3.
- Mar 21, 2024 — Horizon3 publishes its analysis. Forescout's victim sees the first attempts.
- Mar 25, 2024 — CISA adds the CVE to KEV.
- Apr 11, 2024 — Forescout publishes Connect:fun.
- Dec 19, 2024 — Kaspersky reports the October 2024 intrusion.
- Apr 13, 2026 — CVE-2026-21643, a second EMS SQL injection, joins KEV.

## Sources

1. [Fortinet PSIRT — FG-IR-24-007: Pervasive SQL injection in DAS component](https://www.fortiguard.com/psirt/FG-IR-24-007)
2. [CVE record — CVE-2023-48788](https://www.cve.org/CVERecord?id=CVE-2023-48788)
3. [NVD — CVE-2023-48788](https://nvd.nist.gov/vuln/detail/CVE-2023-48788)
4. [CISA — Known Exploited Vulnerabilities: CVE-2023-48788](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48788)
5. [Fortinet PSIRT — FG-IR-25-1142: SQLi in administrative interface (CVE-2026-21643)](https://fortiguard.fortinet.com/psirt/FG-IR-25-1142)
6. [Fortinet PSIRT — FG-IR-26-099: API authentication and authorization bypass (CVE-2026-35616)](https://fortiguard.fortinet.com/psirt/FG-IR-26-099)
7. [Horizon3.ai — CVE-2023-48788: Fortinet FortiClientEMS SQL Injection Deep Dive](https://www.horizon3.ai/attack-research/attack-blogs/cve-2023-48788-fortinet-forticlientems-sql-injection-deep-dive/)
8. [Forescout Vedere Labs — Connect:fun: New exploit campaign in the wild targets media company](https://www.forescout.com/blog/connectfun-new-exploit-campaign-in-the-wild-targets-media-company/)
9. [Kaspersky Securelist — Patched FortiClient EMS vulnerability exploited in the wild](https://securelist.com/patched-forticlient-ems-vulnerability-exploited-in-the-wild/115046/)
10. [The Hacker News — Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools](https://thehackernews.com/2024/12/hackers-exploiting-critical-fortinet.html)

---
Source page: https://erroneo.us/security/briefs/forticlient-ems-cve-2023-48788-sql-injection-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt