CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Vulnerability
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
Published Mar 12, 2024 · Updated Jun 17, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Fortinet vulnerabilities
All Fortinet entriesCVE-2026-104286
Fortinet FortiMail Path Traversal Vulnerability
critical9.8ExploitedOct 1, 2026CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedJun 9, 2026CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability
medium6.5ExploitedApr 14, 2026CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedApr 14, 2026CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability
critical9.8ExploitedApr 4, 2026CVE-2025-68686
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
medium5.9ExploitedFeb 10, 2026