CVE-2023-45581 is a high severity improper privilege management flaw in Fortinet FortiClientEMS, scored 8.8. A site administrator with Super Admin rights can perform global operations that affect other sites. Upgrade to 7.2.3 or 7.0.11 or later. The flaw needs an existing administrator account, not an outsider.
What's affected
Fortinet's advisory FG-IR-23-357 gives the affected and fixed versions by branch:
- 7.2 branch: 7.2.0 through 7.2.2 are affected. Upgrade to 7.2.3 or later.
- 7.0 branch: 7.0.0 through 7.0.4 and 7.0.6 through 7.0.10 are affected. Upgrade to 7.0.11 or later.
- 6.4 and 6.2 branches: all versions are affected. Migrate to a fixed release.
The advisory does not list 7.0.5, so its status is not stated there. Ask Fortinet or move to 7.0.11 or later anyway.
There is a small conflict between sources. The NVD description says "7.2.0 through 7.2.2 and before 7.0.10", which would put 7.0.10 outside the range. The advisory lists 7.0.6 through 7.0.10 as affected and names 7.0.11 as the fix, so use the advisory. The score agrees: 8.8, with a temporal score of 7.9 in the advisory.
How to check if you're exposed
In the FortiClientEMS console, the version is shown on the dashboard and in the About or system information page. Compare it with the branch list above.
If your deployment uses multiple sites, also list who holds Super Admin rights on each site. The flaw needs that role, so the number of such accounts is your exposure indicator.
Fortinet's own upgrade path tool is the safest way to plan the move between branches, since FortiClientEMS upgrades have an order.
What to do now
- Record your FortiClientEMS version and branch.
- Upgrade 7.2 installs to 7.2.3 or later, and 7.0 installs to 7.0.11 or later.
- Plan a migration for 6.4 and 6.2, where all versions are listed as affected.
- List all site administrators with Super Admin privileges on multi site setups and remove those that are not needed.
- Review audit logs for global operations that came from site level administrators.
Why it matters
The weakness is improper privilege management, CWE-269. In a multi site design, an administrator of one site should only manage that site. Here a site administrator with Super Admin privileges can issue crafted requests that act on other sites, which breaks the separation the design promises.
The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. It needs network access and a low privileged account, which in this case means an existing administrator. For managed service providers and large organizations, that is a real boundary: one tenant's admin should never reach another tenant.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory does not say it is exploited. Endpoint management servers hold the keys to every managed device, so tenant isolation bugs deserve a prompt upgrade.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need an unauthenticated attacker?
No. It needs a site administrator with Super Admin privileges, per the record.
Is 7.0.5 affected?
The advisory does not list it. Upgrade to 7.0.11 or later regardless.
Sources
Last reviewed: 19 October 2026.
