CVE-2023-27997

A critical heap-based buffer overflow vulnerability has been identified in specific versions of FortiOS and FortiProxy, which are widely used network security products. This type of vulnerability occurs when a program writes more data to a buffer located on the heap than it can hold, potentially leading to memory corruption. In this case, the affected versions include FortiOS versions up to 7.2.4, 7.0.11, 6.4.12, and 6.0.16, as well as FortiProxy versions up to 7.2.3, 7.0.9, and earlier iterations. The flaw allows an attacker to craft specific requests that can exploit this buffer overflow, leading to the execution of arbitrary code or commands on the affected systems.

The attack vectors for this vulnerability are particularly concerning due to the remote nature of the exploitation. An attacker could leverage this flaw by sending specially crafted requests over the network, targeting devices running the vulnerable versions of FortiOS and FortiProxy. This could be done without requiring physical access to the device, making it easier for malicious actors to exploit the vulnerability from anywhere on the internet. Scenarios could include unauthorized access to sensitive data, disruption of services, or even complete system takeover, depending on the privileges of the compromised application.

The real-world impact of this vulnerability is significant, especially for organizations relying on Fortinet products for their security infrastructure. Given the high CVSS score of 9.8, the risk associated with exploitation is classified as critical. Successful exploitation could lead to severe consequences, including data breaches, loss of customer trust, regulatory penalties, and financial losses. Organizations that fail to address this vulnerability may find themselves at a heightened risk of cyberattacks, particularly from threat actors who are actively scanning for vulnerable systems.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-faceted approach. First and foremost, updating to the latest patched versions of FortiOS and FortiProxy is crucial, as this will eliminate the vulnerability at its source. Regular vulnerability assessments and penetration testing should be conducted to identify any potential weaknesses in the network. Additionally, organizations should employ intrusion detection and prevention systems (IDPS) to monitor for unusual traffic patterns that may indicate an attempted exploitation. Implementing strict access controls and network segmentation can further reduce the attack surface and limit the potential impact of any successful exploitation.

In conclusion, the heap-based buffer overflow vulnerability in FortiOS and FortiProxy presents a serious threat to organizations that utilize these products. The ability for remote attackers to execute arbitrary code underscores the need for immediate action to patch affected systems. By adopting a proactive security posture that includes timely updates, continuous monitoring, and robust access controls, organizations can significantly mitigate the risks associated with this vulnerability and protect their critical assets from potential exploitation.

Recent developments indicate a slight adjustment in the CVSS score for CVE-2023-27997, lowering it from 9.8 to 9.2, reflecting a refined understanding of the vulnerability’s impact and exploitability. Despite this marginal decrease, the exploit landscape has notably expanded, with several new proof-of-concept tools emerging in the public domain. CSURFACE threat intelligence has detected a steady presence of these tools, facilitating easier identification and exploitation of vulnerable FortiOS and FortiProxy SSL-VPN instances. Our telemetry also confirms ongoing ransomware activity linked to this vulnerability, reinforcing its operational use by threat actors. Although the EPSS score shows a negligible decline, the 7-day trend indicates a slight upward movement in exploitation attempts, underscoring persistent adversary interest. These factors collectively sustain the vulnerability’s critical threat level, emphasizing that defenders must remain vigilant as exploitation avenues broaden and ransomware groups continue to leverage this weakness in their campaigns.

Update 2 — July 04, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2023-27997, accompanied by an upward revision of the CVSS score to 9.8, reflecting an increased potential for remote code execution and system compromise. This heightened activity correlates with the emergence of additional proof-of-concept exploits publicly available on GitHub, which lowers the barrier for threat actors to weaponize the vulnerability. Notably, ransomware groups continue to integrate this exploit into their campaigns, sustaining its operational relevance and amplifying the risk to vulnerable FortiOS and FortiProxy SSL-VPN deployments. The combination of intensified exploitation signals and expanded exploit tooling underscores a critical threat environment, necessitating elevated vigilance from defenders. Consequently, the risk assessment for this vulnerability has been elevated, affirming its status as a high-priority target for adversaries seeking initial access and lateral movement within enterprise networks.

Update 3 — July 14, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2023-27997, with telemetry indicating a doubling in detection frequency over recent monitoring periods. This surge coincides with the emergence of additional publicly available proof-of-concept exploits, broadening the toolkit accessible to threat actors. The sustained integration of this vulnerability into ransomware campaigns remains a critical concern, as adversaries continue leveraging it for initial access and lateral movement within compromised networks. Although the Exploit Prediction Scoring System (EPSS) score remains stable, the qualitative increase in observed activity and expanded exploit resources amplify the operational risk. Consequently, the threat level associated with CVE-2023-27997 has intensified, underscoring its prioritization in defensive postures and threat hunting efforts.

Update 4 — July 23, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2023-27997, reflected by a significant uptick in detection activity across multiple environments. This surge coincides with the emergence of additional proof-of-concept exploits publicly available on code repositories, broadening the toolkit accessible to threat actors. The increased operational tempo is particularly concerning given the vulnerability’s established use in ransomware campaigns, with known groups intensifying efforts to leverage this flaw for initial access and lateral movement. While the EPSS score remains stable, the qualitative increase in telemetry and expanded exploit resources indicate a heightened exploitation risk. Consequently, the threat level associated with CVE-2023-27997 has intensified, warranting elevated vigilance in monitoring and defensive measures.

Update 5 — August 15, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2023-27997, accompanied by the emergence of additional proof-of-concept tools that lower the barrier for adversaries to weaponize this vulnerability. Our telemetry indicates that threat actors, including ransomware groups with established ties to this flaw, are intensifying their operational tempo, leveraging the expanded exploit toolkit to facilitate initial access and lateral movement within compromised networks. This development amplifies the risk profile of CVE-2023-27997 beyond prior assessments, as the broadened availability of exploitation resources correlates with increased attack sophistication and persistence. Although the EPSS score remains stable, the qualitative surge in exploitation activity and the proliferation of publicly accessible exploits underscore a heightened threat environment, necessitating increased vigilance from defenders monitoring FortiOS and FortiProxy deployments.