CVE-2023-48786 Server-side request forgery in FortiClientEMS

What is CVE-2023-48786?

CVE-2023-48786 is a medium-severity server-side request forgery vulnerability in Fortinet FortiClientEMS, published on 10 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A server-side request forgery vulnerability [CWE-918] in Fortinet FortiClientEMS version 7.4.0 through 7.4.2 and before 7.2.6 may allow an authenticated attacker to perform internal requests via crafted HTTP or HTTPS requests.

Weakness: CWE-918

Which versions are affected by CVE-2023-48786?

It affects 1 product.

Products include Fortinet Forticlientems.

How do I fix CVE-2023-48786?

No fix has been published for CVE-2023-48786 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-48786 being exploited?

There is no known exploitation of CVE-2023-48786 in the wild and no public exploit code.

Other vulnerabilities in Fortinet FortiClientEMS

• CVE-2026-35616 Fortinet FortiClient EMS Improper Access Control Exploited Critical 9.1
• CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Exploited Critical 9.1
• CVE-2024-23106 Auth bypass in FortiClientEMS High 7.7
• CVE-2025-59922 SQL injection in FortiClientEMS Medium 6.8
• CVE-2026-59836 Security feature bypass in FortiClientEMS Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jvmq-cr7f-mvjw.