CVE-2023-45590 is a critical code injection flaw in Fortinet FortiClientLinux, scored 9.6. A user who visits a malicious website can end up running unauthorized code. Upgrade to 7.2.1 or later on the 7.2 branch, or 7.0.11 or later on the 7.0 branch.
What's affected
Fortinet advisory FG-IR-23-087, published on 9 April 2024, lists:
- FortiClientLinux 7.2.0: upgrade to 7.2.1 or later.
- FortiClientLinux 7.0.6 through 7.0.10: upgrade to 7.0.11 or later.
- FortiClientLinux 7.0.3 through 7.0.4: upgrade to 7.0.11 or later.
- The 6.4 branch is not affected.
The advisory rates it critical, with a base score of 9.6 and a temporal score of 9.4. The NVD record agrees on the score and the version ranges. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H: reachable over the network, no privileges needed, one user action, and a changed scope.
How to check if you're exposed
On a Linux workstation, check which FortiClient package is installed and which version it is. Package names can differ between installs, so confirm against your software source.
dpkg -l | grep -i forticlient
rpm -qa | grep -i forticlient
Match the version against the lists above. Because the trigger is visiting a web page, the exposure tracks with who browses the web on machines that run the client, which for developer Linux desktops is nearly everyone.
What to do now
- Find Linux endpoints that run FortiClientLinux and record their versions.
- Upgrade 7.2.0 to 7.2.1 or later, and 7.0.3 to 7.0.10 to 7.0.11 or later.
- Push the update through your endpoint management tool, and verify the installed version after rollout.
- Remind affected users that the trigger is a malicious site, and report suspicious pages to the security team.
- Keep Linux VPN clients in the same patch cycle as the rest of your endpoint software.
Why it matters
The weakness is improper control of code generation, CWE-94, usually called code injection. Data from outside is treated as code and run. The NVD description says an attacker can get unauthorized code or commands executed by tricking a FortiClientLinux user into visiting a malicious website.
Remote access clients run on the machines of administrators and developers, often with access to internal networks. A flaw that turns a web visit into code execution there is more serious than the same flaw in a rarely used utility, which is why the score reaches 9.6.
The CVE is not on the CISA Known Exploited Vulnerabilities list, and the advisory I read does not report exploitation. Patch on the normal fast track for client software with network reach.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need credentials?
No. The vector shows no privileges required, but a user has to visit a malicious website.
Are FortiClient 6.4 versions affected?
The advisory says the 6.4 branch is not affected.
Sources
Last reviewed: 19 October 2026.
