--- id: "CVE-2023-27997" kind: "vulnerability" aliases: ["CVE-2023-27997"] title: "A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below,\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Fortinet FortiOS and FortiProxy SSL-VPN", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 1.1.0, <= 1.1.6", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 1.2.0, <= 1.2.13", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 2.0.0, <= 2.0.12", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.0.0, <= 7.0.9", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.2.0, <= 7.2.3", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 6.0.0, <= 6.0.16", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 6.2.0, <= 6.2.13", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 6.4.0, <= 6.4.12", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 7.0.0, <= 7.0.11", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 7.2.0, <= 7.2.4", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 6.0.12, <= 6.0.16", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 6.2.9, <= 6.2.13", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.0.10", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.2.4", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.2.6", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.2.7", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.4.2", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.4.6", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.4.8", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.4.10", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 6.4.12", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 7.0.5", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": "= 7.0.10", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "fortinet", "fortios", "fortiproxy", "infrastructure", "ransomware", "ssl-vpn"] not_affected_if: ["managed-hosting", "ssl-vpn-disabled"] published_at: "2023-06-13T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T22:29:04+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27997", "first_seen_at": "2026-10-23T22:29:04+00:00"}] --- # A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below,… Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow that lets an unauthenticated remote attacker send crafted requests and execute code or commands. CISA lists it as actively exploited in the wild, with ransomware use noted. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Fortinet FortiOS and FortiProxy SSL-VPN affected ? fixed ? - vendor:fortinet fortiproxy affected >= 1.1.0, <= 1.1.6 fixed ? - vendor:fortinet fortiproxy affected >= 1.2.0, <= 1.2.13 fixed ? - vendor:fortinet fortiproxy affected >= 2.0.0, <= 2.0.12 fixed ? - vendor:fortinet fortiproxy affected >= 7.0.0, <= 7.0.9 fixed ? - vendor:fortinet fortiproxy affected >= 7.2.0, <= 7.2.3 fixed ? - vendor:fortinet fortios affected >= 6.0.0, <= 6.0.16 fixed ? - vendor:fortinet fortios affected >= 6.2.0, <= 6.2.13 fixed ? - vendor:fortinet fortios affected >= 6.4.0, <= 6.4.12 fixed ? - vendor:fortinet fortios affected >= 7.0.0, <= 7.0.11 fixed ? - vendor:fortinet fortios affected >= 7.2.0, <= 7.2.4 fixed ? - vendor:fortinet fortios affected >= 6.0.12, <= 6.0.16 fixed ? - vendor:fortinet fortios affected >= 6.2.9, <= 6.2.13 fixed ? - vendor:fortinet fortios affected = 6.0.10 fixed ? - vendor:fortinet fortios affected = 6.2.4 fixed ? - vendor:fortinet fortios affected = 6.2.6 fixed ? - vendor:fortinet fortios affected = 6.2.7 fixed ? - vendor:fortinet fortios affected = 6.4.2 fixed ? - vendor:fortinet fortios affected = 6.4.6 fixed ? - vendor:fortinet fortios affected = 6.4.8 fixed ? - vendor:fortinet fortios affected = 6.4.10 fixed ? - vendor:fortinet fortios affected = 6.4.12 fixed ? - vendor:fortinet fortios affected = 7.0.5 fixed ? - vendor:fortinet fortios affected = 7.0.10 fixed ? ## Fix Apply the vendor's updates for FortiOS and FortiProxy per Fortinet's advisory; the fixed versions are not stated in the sources. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27997 - 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-27997 ## From the sources A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_