CVE-2023-48788

This vulnerability is like a door in your building that shouldn’t open for everyone—but attackers found a way to slip in a “coded request” through the network. If FortiClientEMS receives those specially crafted requests, the attacker can cause the system to run actions it wasn’t supposed to run, including unauthorized code or commands. Think of it as a flaw in how the software “reads” and “trusts” what it’s told over the internet.

This matters to you if you use or run Fortinet FortiClientEMS (Fortinet FortiClient Enterprise Management Server), specifically versions 7.2.0 through 7.2.2 and 7.0.1 through 7.0.10. If your business relies on FortiClientEMS to manage Fortinet clients or enterprise device enrollment, you should assume attackers may target it—especially because it is known to be exploited in the wild.

This is RED urgency because there is evidence of active, real-world exploitation (“known exploited in the wild” and press notes it is being used in attacks/ransomware). With a very high likelihood of exploitation in the next 30 days and an industry alert listing, you should act immediately rather than waiting for a future maintenance window.