FortiClient EMS Exploit: What UK and NZ Businesses Must Do Now

What Is CVE-2023-48788 and Why Does It Matter?

CVE-2023-48788 is a critical SQL injection vulnerability in Fortinet's FortiClient Endpoint Management Server (EMS). Fortinet patched it in March 2024 and assigned it a CVSS score of 9.8 out of 10 — as serious as vulnerabilities get. Threat intelligence company Defused has now confirmed that attackers are actively exploiting it in the wild. FortiClient EMS is the server-side component that organisations use to manage endpoint security policies across their fleet of Windows devices. It handles device registration, VPN configuration, and compliance enforcement. That makes it a high-value target: compromise the EMS server and you gain a foothold directly into the management layer of a corporate network. The flaw works as a SQL injection. An unauthenticated attacker sends a specially crafted request to the EMS server's database interface. The server processes it as a legitimate query, allowing the attacker to manipulate the underlying database and, critically, execute arbitrary commands on the operating system. No username. No password. No social engineering required.

How Does This Attack Actually Work?

Think of it like a waiter who passes your order directly to the kitchen without reading it first. If you write your 'order' in the kitchen's own language — and include instructions the chef wasn't expecting — you can get the kitchen to do whatever you want. In this case, the FortiClient EMS server is the kitchen, and the attacker's malformed database query is the unexpected instruction. Because the server doesn't properly sanitise input before passing it to the Microsoft SQL Server database it relies on, the attacker can append commands that the database executes with elevated privileges. From there, attackers can drop web shells onto the server, create rogue administrator accounts, move laterally through the internal network, or deploy ransomware. Researchers at Horizon3.ai published a technical proof-of-concept in April 2024, which significantly lowered the barrier for less sophisticated attackers to weaponise the flaw. That is the point at which theoretical risk becomes active exploitation — and based on Defused's findings, that transition has now happened.

Who Is Exposed?

Any organisation running FortiClient EMS versions 7.0.1 through 7.0.10, or versions 7.2.0 through 7.2.2, is vulnerable if they have not applied Fortinet's patch. The fixed versions are 7.0.11 and 7.2.3 respectively. The exposure is particularly sharp for organisations that have their EMS server accessible from the internet — a configuration that is more common than it should be, especially in distributed or hybrid working environments where remote device management is a priority. However, even internally-facing EMS servers carry risk: once an attacker is inside your perimeter through any other means, an unpatched EMS server becomes a quick path to domain-level compromise. For UK and New Zealand businesses relying on Fortinet's endpoint management stack, the question is not whether this threat is real — it is whether your patching cadence caught this before attackers did.

• Affected: FortiClient EMS 7.0.1–7.0.10 and 7.2.0–7.2.2
• Fixed in: FortiClient EMS 7.0.11 and 7.2.3
• Risk is elevated if the EMS server is internet-facing
• Internal-only deployments still carry lateral movement risk

Why Patching Alone Is Not Enough

Patch immediately — that is non-negotiable. But patching closes the door on future exploitation. It does nothing to tell you whether someone walked through it before you locked it. This is the gap that catches organisations out. A vulnerability sits unpatched for weeks or months, a threat actor exploits it quietly, and the organisation applies the patch believing the problem is solved. Meanwhile, a web shell installed before the patch remains active. A rogue admin account created pre-patch persists unnoticed. This is precisely the scenario where continuous attack surface monitoring and 24/7 managed detection matter. Hadrian, the AI-powered attack surface management platform we deploy for clients, continuously scans externally-facing infrastructure for exposed services and known vulnerable software versions — it would flag an internet-accessible FortiClient EMS server running a vulnerable version before attackers find it. That kind of outside-in visibility is what bridges the gap between 'patch released' and 'patch applied'. Equally, Sophos MDR provides round-the-clock threat hunting and detection. If an attacker did gain access before patching, the behavioural indicators — unusual process execution from the EMS server, unexpected outbound connections, new local admin account creation — are precisely the signals that a managed detection and response service is built to catch and act on.

What Should Organisations Do Right Now?

The immediate actions are clear and time-sensitive. Active exploitation means the window for remediation without incident is closing.

• Apply Fortinet's patch to FortiClient EMS immediately — update to version 7.0.11 or 7.2.3
• Audit firewall rules to confirm whether your EMS server is accessible from the public internet — if it is, restrict access to known IP ranges as an interim measure
• Review EMS server logs for anomalous database activity, unexpected process executions, or new administrator account creation dating back to at least April 2024 when the proof-of-concept was published
• Search for web shells in the EMS server's web directories — common filenames include variations of 'shell.aspx', 'cmd.aspx', and randomised strings
• If compromise is suspected, isolate the server and engage incident response before attempting remediation in place
• Check whether your vulnerability management process receives and acts on Fortinet's PSIRT advisories in a defined timeframe

The Bigger Pattern: Enterprise Management Tools Are Prime Targets

CVE-2023-48788 is not an isolated incident. It sits within a sustained pattern of attackers targeting enterprise management and security infrastructure — the tools organisations use to control and monitor their environments. Consider the recent history: Ivanti Connect Secure, Palo Alto Networks PAN-OS, Cisco IOS XE, and now Fortinet EMS. In each case, a vulnerability in a product designed to manage or protect other systems became the entry point. Attackers understand the value of these targets — compromise a management layer and you inherit visibility and control over everything it manages. The CISA Known Exploited Vulnerabilities catalogue, which tracks flaws confirmed to be actively exploited, listed 1,087 entries as of early 2025. A disproportionate share of high-severity entries involve network security appliances and management platforms from major vendors. This is a deliberate strategic focus by threat actors, not coincidence. For organisations in the UK and across New Zealand and Australia, supply chain and third-party exposure compounds this risk further. If a managed service provider or IT partner runs FortiClient EMS to manage your environment, their unpatched server is your risk too. Panorays, which we use to assess and monitor third-party cyber posture, is designed to surface exactly this kind of inherited exposure — giving you visibility into vulnerabilities in your vendor ecosystem before they become your incident.

Protecting Endpoints When the Manager Is Compromised

There is a final consideration worth addressing directly: if an attacker compromises your endpoint management server, what stops them from pushing malicious policy changes or software to every managed device? The answer is endpoint protection that operates independently of the management layer. ESET's enterprise endpoint protection, deployed across our New Zealand and Australasia client base, maintains its protection capabilities and threat detection at the device level — it does not depend on the management server being trustworthy to continue blocking threats. Similarly, BlackFog's anti data exfiltration technology runs at the endpoint and blocks unauthorised outbound data transfers regardless of what instructions arrive from a management server. In a scenario where an attacker has seized control of FortiClient EMS and attempts to use it as a distribution mechanism for malware, layered endpoint defences are the last line. This is what genuine defence-in-depth looks like in practice: not a single product that does everything, but independent layers that each assume the others might fail.

Frequently Asked Questions