Vulnerability intelligence

CVE-2023-27997

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

Fortinet FortiOS and FortiProxy SSL-VPN

Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.

CVSS Score

9.2

Critical

EPSS — Exploit Probability

—

Awaiting FIRST.org data

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

unknown

Federal deadline 2023-07-04

CISA required action

Apply updates per vendor instructions. Deadline for federal agencies: 2023-07-04.

NVD entry PoC / advisory CISA KEV

1 article across 1 outlet · first covered Sep 15, 2026 · latest Sep 15, 2026

Coverage timeline

Attackers Exploited Fortinet and F5 Flaws to Target Thai ISP 3BB
www.securityweek.com · Sep 15, 2026

Related CVEs — Fortinet

CVE-2018-13379KEV CVE-2022-42475KEV CVE-2024-21762KEV CVE-2025-25249KEV CVE-2026-26084 CVE-2026-84393 CVE-2024-55591KEV CVE-2026-26035