What’s Vulnerable › Vulnerabilities

CVE-2023-27997: Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2023-06-13
• EPSS: 85.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-13 · updated 2026-07-31
• Weakness: CWE-122

Description

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Affected products

• Fortinet FortiOS (FortiGate): from 6.0.0 through 6.0.16; from 6.2.0 through 6.2.13; from 6.4.0 through 6.4.12; from 7.0.0 through 7.0.11; from 7.2.0 through 7.2.4; from 6.0.12 through 6.0.16
• Fortinet FortiProxy: from 1.1.0 through 1.1.6; from 1.2.0 through 1.2.13; from 2.0.0 through 2.0.12; from 7.0.0 through 7.0.9; from 7.2.0 through 7.2.3

References

• https://fortiguard.com/psirt/FG-IR-23-097
• https://fortiguard.com/psirt/FG-IR-23-097
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997

Get alerted when CVE-2023-27997 or the next vulnerability affects your stack