Patch Now: Critical Fortinet RCE Bug Under Active Attack

Executive summary: A critical SQL injection vulnerability (CVE-2023-48788, CVSS 9.3) in Fortinet FortiClient EMS can allow unauthenticated attackers to execute arbitrary code on affected systems. Researchers published a proof-of-concept demonstrating exploitation via the FcmDaemon service and use of SQL Server functionality to escalate to RCE; CISA has added the flaw to its Known Exploited Vulnerabilities catalog and Fortinet has released patches. Organizations are urged to patch immediately and examine FortiClient EMS and MS SQL logs for signs of exploitation (unexpected client connections or xp_cmdshell activity).