CVE-2023-27997

What it actually does

CVE-2023-27997 is a pre-authentication heap-based buffer overflow in the FortiOS and FortiProxy SSL-VPN service. A remote, unauthenticated attacker can send specially crafted SSL-VPN requests to corrupt heap memory and execute arbitrary code or commands on the appliance. Because the vulnerable component is commonly internet-facing and the CVSS vector requires no privileges or user interaction, successful exploitation can result in full compromise of the VPN gateway, including command execution, credential theft, configuration access, persistence, and disruption of VPN availability.

Why it matters to the business

This vulnerability affects edge security infrastructure that often protects remote access into the organization. Exploitation can allow attackers to take control of the VPN appliance, steal credentials or session data, pivot into internal networks, disrupt remote access, and support ransomware operations. It is listed in CISA KEV, is associated with ransomware use, has high EPSS likelihood, and has been actively exploited in the wild, so unpatched FortiOS and FortiProxy SSL-VPN deployments should be treated as high-priority emergency remediation items. The CISA KEV remediation due date was 2023-07-04, making any remaining exposure substantially overdue.

How an attack unfolds

An attacker scans the internet for FortiOS or FortiProxy SSL-VPN interfaces exposed on HTTPS, typically on port 443 or custom SSL-VPN ports. Without needing credentials, the attacker sends malformed SSL-VPN requests designed to trigger the heap overflow in vulnerable FortiOS or FortiProxy versions. If exploitation succeeds, the attacker gains code or command execution in the context of the SSL-VPN process or appliance. From there, they may dump configuration data, harvest VPN credentials or session artifacts, add or modify local users, deploy persistence, alter logs, proxy traffic, or use the compromised VPN as an entry point for lateral movement. In ransomware-driven intrusions, this access may be followed by internal reconnaissance, credential reuse, privilege escalation, data exfiltration, and deployment of encryptors.

How to fix it

Upgrade FortiOS and FortiProxy to Fortinet-supported fixed releases that address CVE-2023-27997. FortiOS versions 7.2.4 and earlier, 7.0.11 and earlier, 6.4.12 and earlier, and 6.0.16 and earlier are affected; FortiProxy versions 7.2.3 and earlier, 7.0.9 and earlier, 2.0.12 and earlier, and all 1.2 and 1.1 versions are affected. If exact target versions are not already defined by change control, use the latest Fortinet advisory and upgrade path for the relevant major branch, preferably moving to the newest supported maintenance release. Disable SSL-VPN on affected appliances until patched if immediate upgrade is not possible. Restrict SSL-VPN exposure to trusted source IP ranges, enforce MFA, rotate administrative and VPN credentials after patching, revoke active VPN sessions, review local and remote authentication configuration, and inspect the appliance for signs of compromise before returning it to service. Because this is a KEV and ransomware-associated vulnerability, mitigation alone should be considered temporary; patching and compromise assessment are required.

How to confirm the fix worked

Confirm the installed FortiOS or FortiProxy version is newer than the affected ranges identified in the Fortinet advisory. Validate through the administrative GUI or CLI version output, and ensure HA cluster members, FortiGate 6000/7000 blades, and standby nodes are also upgraded. Verify SSL-VPN is disabled or restricted if a patched version cannot be deployed immediately. From an external vantage point, confirm only intended SSL-VPN endpoints are reachable and that access controls are enforced. Review Fortinet release notes or advisory checks to confirm the build includes the fix for CVE-2023-27997. After remediation, rotate VPN and administrative credentials, terminate existing sessions, and perform a compromise assessment by reviewing VPN logs, administrator logs, configuration changes, crash logs, and unexpected processes or files. A successful validation should show patched versions everywhere, no unrestricted vulnerable SSL-VPN exposure, no unexplained configuration drift, and no indicators of prior exploitation.

Typical attack path

1. Identify internet-exposed FortiOS or FortiProxy SSL-VPN portals through scanning, certificate metadata, banners, or known VPN URL patterns.
2. Confirm the target appears to be a Fortinet SSL-VPN service and infer whether it may be running an affected version.
3. Send specially crafted unauthenticated SSL-VPN requests that trigger heap memory corruption.
4. Achieve arbitrary code or command execution on the VPN appliance if exploitation is reliable against the target version and build.
5. Collect appliance configuration, VPN user information, credentials, session artifacts, routing details, and trusted network information.
6. Establish persistence or create unauthorized access paths where possible, such as modified accounts, altered configuration, web shell-like appliance artifacts, or external command-and-control channels.
7. Use the compromised VPN appliance to access internal systems, perform reconnaissance, and move laterally.
8. For ransomware-motivated activity, exfiltrate data, disable defenses where possible, and deploy ransomware or other destructive payloads.

How to detect it

Investigate FortiOS and FortiProxy devices that exposed SSL-VPN while running affected versions. Review FortiGate/FortiProxy event logs, VPN logs, traffic logs, administrator logs, system crash logs, configuration revision history, and any centralized syslog/SIEM data. Look for SSL-VPN process crashes or restarts before patching, repeated malformed or unusual HTTPS requests to SSL-VPN endpoints, spikes in failed SSL-VPN negotiation activity, unexplained successful VPN logins, logins from unfamiliar countries or hosting providers, and VPN sessions outside normal hours. Examine admin activity for unauthorized logins, creation of local users, changes to admin profiles, changes to SSL-VPN portals, new firewall policies, altered authentication servers, modified routes, or unexpected configuration exports. Inspect for evidence of post-exploitation such as internal scanning from VPN-assigned addresses, connections from the appliance to unusual external IPs, abnormal DNS lookups, or command-and-control-like outbound traffic. Because public reporting for this vulnerability does not provide a single universal exploit string that is safe to rely on, detection should combine version exposure, SSL-VPN access patterns, crash artifacts, configuration drift, and downstream network behavior. For ransomware-related investigations, correlate VPN access with later credential abuse, lateral movement, data staging, backup access, security tool tampering, and encryption activity.

• FortiOS version 7.2.4
• FortiOS version 7.0.11
• FortiOS version 6.4.12
• FortiOS version 6.0.16
• FortiProxy version 7.2.3
• FortiProxy version 7.0.9
• FortiProxy version 2.0.12
• /remote/login
• /remote/hostcheck_validate
• /remote/fortisslvpn
• /remote/saml/start
• sslvpnd
• SSL-VPN
• sslvpn
• SSL VPN login successfully
• SSL VPN logout
• Administrator login successful
• Configuration changed
• Local user added
• User added
• Admin user added
• segmentation fault
• crashlog
• ipsengine
• httpsd

What your security team should do

• Immediately inventory all FortiOS, FortiProxy, FortiGate 6000, and FortiGate 7000 appliances, including HA peers, lab systems, and externally managed devices, and identify any SSL-VPN exposure.
• Patch or upgrade all affected appliances as an emergency priority; this vulnerability is actively exploited, listed in CISA KEV, associated with ransomware campaigns, and the KEV due date has passed.
• If patching cannot occur immediately, disable SSL-VPN or restrict it to trusted source IP ranges until the appliance is upgraded.
• Run a compromise assessment on any device that was internet-facing while running an affected version, even if it is now patched.
• Rotate local administrator passwords, VPN user passwords, API keys, and shared secrets after patching, and revoke active VPN sessions.
• Review FortiOS and FortiProxy configuration for unauthorized local users, changed admin profiles, unexpected firewall policies, altered VPN settings, modified authentication servers, and suspicious automation or script settings.
• Monitor for anomalous VPN logins, impossible travel, new source geographies, unusual user agents, large configuration downloads, and internal scanning originating from VPN address pools.
• Preserve logs and forensic artifacts before rebooting or factory resetting appliances where compromise is suspected.
• Place Fortinet SSL-VPN management and access interfaces behind allowlists where operationally feasible and enforce MFA for all remote access.
• Track Fortinet PSIRT advisories and confirm future branch-specific fixed versions are applied promptly, especially for edge appliances.