Patched FortiClient EMS Flaw Still a Live Attack Vector for Credential Theft

A critical SQL injection bug in FortiClient Endpoint Management Server is still being weaponized months after Fortinet shipped a fix, with attackers using compromised EMS instances to distribute credential-stealing malware to every endpoint the server manages.

The flaw is CVE-2023-48788, an unauthenticated SQLi in the FcmDaemon component of FortiClient EMS that allows arbitrary code execution as SYSTEM. Fortinet's advisory rates it 9.8. Patches landed in March 2024.

The newer campaign flips the trust model. Once an EMS server is compromised, attackers use it as a distribution channel, pushing a payload that masquerades as a Fortinet endpoint component down to managed clients. The malware is an infostealer aimed at browser-stored credentials, session tokens, and saved authentication material.

That is the part worth dwelling on. EMS is the thing IT teams trust to talk to every laptop in the fleet. When the management server gets owned, every downstream agent becomes a delivery target, and the binary arrives signed-looking and named to blend in.

Researchers tracking the activity say the operators are deliberately staging the stealer to look like a Fortinet update artifact, which buys time against EDR triage and helps the file survive a casual look from a sysadmin. Lateral movement and persistence tooling have also been observed on compromised EMS hosts.

This is not a novel vulnerability story. It is a patch-compliance story. CVE-2023-48788 has been on CISA's Known Exploited Vulnerabilities catalog since March 2024, with a federal remediation deadline that has long since passed. Internet-exposed EMS instances remain.

Jurisdiction and notification exposure

For US operators, a credential stealer deployed via a managed endpoint platform is the kind of incident that triggers state breach-notification statutes the moment exfiltrated data touches names plus any other regulated identifier. If the affected entity is a public company, the SEC's four-business-day Item 1.05 8-K clock starts at materiality determination. EU operators face GDPR Article 33's 72-hour window to the relevant supervisory authority. UK deployments answer to the ICO on the same timeline.

What affected organizations should do

If you run FortiClient EMS and have not patched to 7.0.11+, 7.2.3+, or later: assume compromise rather than treat patching as sufficient. Pull EMS server logs for anomalous SQL queries against the FCTUID parameter, review any agent-pushed binaries from the last several months against Fortinet's published hashes, and rotate credentials for every account that authenticated from a managed endpoint during the suspected exposure window. Reissue session tokens. Force a password reset for SSO-federated accounts that touched affected hosts.

The vulnerability is patchable. The trust relationship between EMS and its agents is not, and that is what this campaign is exploiting.