CVE-2023-27997
CISA KEV RANSOMWARE
ACT NOW
Priority: 0.00
BB Relevance:
10/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
CISA Known Exploited Vulnerability
Vendor / Product
Fortinet — FortiOS and FortiProxy SSL-VPN
Date Added
2023-06-13
Remediation Due
2023-07-04
Ransomware Use
CONFIRMED
https://www.fortiguard.com/psirt/FG-IR-23-097; https://nvd.nist.gov/vuln/detail/CVE-2023-27997
Affected Software (23)
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortios | 6.0.0 – 6.0.16 |
| fortinet | fortios | 6.2.0 – 6.2.13 |
| fortinet | fortios | 6.4.0 – 6.4.12 |
| fortinet | fortios | 7.0.0 – 7.0.11 |
| fortinet | fortios | 7.2.0 – 7.2.4 |
| fortinet | fortios | 6.0.12 – 6.0.16 |
| fortinet | fortios | 6.2.9 – 6.2.13 |
| fortinet | fortios | 6.0.10 |
| fortinet | fortios | 6.2.4 |
| fortinet | fortios | 6.2.6 |
| fortinet | fortios | 6.2.7 |
| fortinet | fortios | 6.4.2 |
| fortinet | fortios | 6.4.6 |
| fortinet | fortios | 6.4.8 |
| fortinet | fortios | 6.4.10 |
| fortinet | fortios | 6.4.12 |
| fortinet | fortios | 7.0.5 |
| fortinet | fortios | 7.0.10 |
| fortinet | fortiproxy | 1.1.0 – 1.1.6 |
| fortinet | fortiproxy | 1.2.0 – 1.2.13 |
| fortinet | fortiproxy | 2.0.0 – 2.0.12 |
| fortinet | fortiproxy | 7.0.0 – 7.0.9 |
| fortinet | fortiproxy | 7.2.0 – 7.2.3 |
References & Advisories (2)
Vendor Advisory
US Government Resource