Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to execute unauthorized code or commands via specially crafted packets.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-04-15. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-09 | 1 | Patch1 |
| 2026-02-18 | 1 | General1 |
| 2026-04-16 | 1 | Active Exploitation1 |
| 2026-06-18 | 1 | Active Exploitation1 |
| 2026-07-27 | 1 | General1 |
| 2026-08-18 | 1 | Active Exploitation1 |
🤖 Nueva noticia de ciberseguridad: FORTICLIENTEMS RCE CVE-2023-48788 Claves técnicas y medidas de mitigación en este boletín ➡️ 📄
Post summary
A bulletin about the CVE‑2023‑48788 RCE in FortiClient EMS provides technical details and mitigation measures.
Medusa ransomware has escalated its attacks, compromising over 500 critical infrastructure organizations. Exploiting vulnerabilities like CVE-2024-1709 and CVE-2023-48788, it employs advanced evasion techniques, including disabling EDR systems and misusing RMM tools. Organizations must prioritize timely patching and robust cybersecurity measures to mitigate this growing threat. #MedusaRansomware #Cybersecurity #CriticalInfrastructure #Ransomware #Infosec #DataBreach https://thedailytechfeed.com/medusa-ransomware-intensifies-attacks-on-critical-infrastructure/
Post summary
Medusa ransomware is actively exploiting CVE-2024-1709 and CVE-2023-48788, having compromised more than 500 critical infrastructure organizations, emphasizing the need for urgent patching and enhanced defenses.
Fortinet FortiClient EMS CVE-2023-48788 shows endpoint management systems are prime targets. Attackers increasingly exploit the tools meant to secure enterprises. Trust in your third-party dependencies must be verified, not assumed.
Post summary
The post flags Fortinet FortiClient EMS CVE‑2023‑48788 as a high‑value target and urges verification of third‑party dependencies, yet it provides no technical details or evidence of exploitation.
INC ransomware affiliates exploited Citrix NetScaler (CVE-2023-3519) and Fortinet FortiClientEMS (CVE-2023-48788) vulnerabilities before pivoting through RDP sessions with stolen domain admin credentials. Runtime segmentation could limit such lateral movement across compromised networks. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/inc-ransomware-2026
Post summary
The post reports active exploitation of CVE-2023-3519 and CVE-2023-48788 by ransomware affiliates, using RDP for lateral movement, and suggests runtime segmentation could mitigate such attacks.
🔒 #CyberSecurity CISA KEV Alert: Remediate Active Exchange SSRF (CVE-2024-26234) and Fortinet RC… "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added critical…" 🔗 https://securityarsenal.com/blog/cisa-kev-alert-remediate-active-exchange-ssrf-cve-2024-26234-and-fortinet-rce-cve-2023-48788 #CyberSecurity #ThreatIntel #cve #zeroday #patchtuesday
Post summary
CISA released an alert for CVE-2024-26234 and Fortinet CVE-2023-48788, indicating these vulnerabilities are actively exploited in the wild and urging immediate remediation.
INC ransomware targets Windows, Linux, and ESXi. It exploits Citrix CVE-2023-3519 and Fortinet CVE-2023-48788 to get in. Full attack lifecycle and IOCs → https://www.provendata.com/blog/inc-ransomware/ #Ransomware #CyberSecurity #IncidentResponse #ThreatIntel #InfoSec #DFIR #RansomwareAttack https://t.co/2Ur8piJCz3
Post summary
The tweet reports that the INC ransomware uses CVE‑2023‑3519 and CVE‑2023‑48788 to target multiple platforms, and directs readers to a blog for the full attack lifecycle and IOCs.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fortinet | forticlient_enterprise_management_server | - | - | - |