CVE-2023-27997: listed in the CISA KEV catalog

CVE-2023-27997 · CVSS 9.8 CRITICAL · EPSS 86% · KEV 2023-06-13

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Is CVE-2023-27997 exploited?

• Listed in the CISA KEV catalog on 2023-06-13.
• Federal remediation due 2023-07-04.
• Past that date by 1138 days.
• Used in ransomware campaigns.
• EPSS puts exploitation in the next 30 days at 86%.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2023-27997

• Patched FortiGates Still Leak Access Through Old Credentials (2026-07-09)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No affected package data.
• No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-11.