CVE-2023-27997

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - psirt@fortinet.com

Published

2023-06-13

Last modified

2026-07-31

Known exploited (CISA KEV)

since 2023-06-13, action due 2023-07-04: Apply updates per vendor instructions.

Weaknesses

CWE-122, CWE-787

Affected products

• Fortios (Fortinet)
• Fortios-6k7k (Fortinet)
• Fortiproxy (Fortinet)

References

• https://fortiguard.com/psirt/FG-IR-23-097
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997