CVE-2023-47534
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
An improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiClientEMS across multiple versions. It allows an attacker to execute unauthorized code or commands via specially crafted packets.
Risk Assessment
Potential code execution on the FortiClientEMS management server, which could lead to compromise of endpoints.
Recommendation
Update FortiClientEMS to the latest patched version. Avoid opening untrusted CSV files within the application context.
Other vulnerabilities in FortiClientEMS
See all- CVE-2025-59922High
An SQL Injection vulnerability in Fortinet FortiClientEMS allows an authenticated attacker with at least read-only admin permission to execute unauthorized SQL code or commands via crafted HTTP/HTTPS requests.
- CVE-2026-35616CriticalActively exploited
An improper access control vulnerability in Fortinet FortiClientEMS versions 7.4.5 through 7.4.6 allows an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
- CVE-2026-59836High
A vulnerability in Fortinet FortiClientEMS allows an attacker to disclose information due to improper certificate validation. Affected versions include 7.4.3-7.4.5, 7.4.0-7.4.1, and all 7.2 versions.
- CVE-2023-45581High
An improper privilege management vulnerability (CWE-269) in Fortinet FortiClientEMS allows a site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests.
Original NVD description (English source)
A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.0 through 7.0.10, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions, FortiClientEMS 06.00 all versions, FortiClientEMS 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted packets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS