CVE-2023-47534 is a CSV formula injection flaw in Fortinet FortiClientEMS. NVD scores it 9.6, Critical. A remote attacker could run commands on the administrator's workstation through crafted log entries. Upgrade FortiClientEMS 7.2 to 7.2.3 or later and 7.0 to 7.0.11 or later. Versions 6.4, 6.2 and 6.0 need a migration.
What's affected
Fortinet's advisory FG-IR-23-390 lists these FortiClientEMS versions and fixes:
- 7.2.0 through 7.2.2: upgrade to 7.2.3 or above.
- 7.0.0 through 7.0.10: upgrade to 7.0.11 or above.
- 6.4, all versions: migrate to a fixed release.
- 6.2, all versions: migrate to a fixed release.
- 6.0, all versions: migrate to a fixed release.
The NVD record lists 6.4.0 through 6.4.9, 6.2.0 through 6.2.9 and 6.0.0 through 6.0.8, which is consistent with the advisory's "all versions" for those lines.
Source conflict on severity: NVD scores this 9.6, Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Fortinet's advisory lists the CVSS v3 score as 9.6 too, but labels the severity High, with a temporal score of 8.7. The advisory marks the issue as unauthenticated and not known to be exploited.
The weakness is CWE-1236, improper neutralization of formula elements in a CSV file.
How to check if you're exposed
In the FortiClientEMS console, open the About or dashboard information and read the server version. Compare it against the list above.
Fortinet states that the attacker needs the administrator to take an action, since the NVD vector carries user interaction as Required. The path described is that the attacker creates malicious log entries through crafted requests to the server, and the harm lands on the admin workstation. Think about who exports logs and where they open the files.
If your estate includes the 6.x lines, those are past the point of in-place fixes according to the advisory. Plan a migration to a fixed release instead of waiting for a patch to that branch.
What to do now
- Upgrade FortiClientEMS 7.2 to 7.2.3 or above, and 7.0 to 7.0.11 or above.
- Migrate any 6.4, 6.2 or 6.0 deployment to a fixed release, since the advisory offers no patch inside those lines.
- Until the upgrade, avoid opening exported CSV logs in a spreadsheet program on administrator workstations.
- If you must export logs, review the files in a plain text viewer first.
- Turn off any spreadsheet setting that runs external commands or links automatically.
Why it matters
CSV injection, also called formula injection, exploits the fact that spreadsheet programs treat some cell contents as instructions. A field that begins with certain characters can be read as a formula. If an application writes untrusted text, such as a log entry, into a CSV file without neutralising those characters, the file carries the attacker's content to whoever opens it.
That is why the harm here lands on the administrator's workstation and not the server. The server stores or exports the entry. The person opening the export is the one at risk. The scope change in the NVD vector (S:C) reflects that: the impact leaves the component that held the flaw.
The fix pattern is to escape or prefix risky leading characters on export, and to warn users about untrusted exports. The class is CWE-1236. This is a good example of why log data should be treated as untrusted input, even when it comes from your own endpoint management system.
Quick check
Is CVE-2023-47534 exploited in the wild?
Fortinet's advisory marks it as not known to be exploited, and the record's CISA KEV flag is false.
Do I need an unauthenticated attacker to worry?
Fortinet lists the attack type as unauthenticated. The attacker's route in is crafted requests to the server, and an administrator then has to open the result.
Sources
Last reviewed: 19 October 2026.
