The KRVTZ-NET IDS alerts dated February 14, 2026, highlight reconnaissance activities targeting Fortinet Fortigate VPN devices by exploiting the CVE-2023-27997 vulnerability. This vulnerability involves repeated GET requests to the /remote/logincheck endpoint, which can be abused to bypass authentication mechanisms on the VPN appliance. The reconnaissance is carried out by automated scanners identified by their HTTP User-Agent strings, with IP addresses such as 167.94.146.49, 206.168.34.198, and 2001:470:1:c84::13 observed performing these scans. The IPv6 address is specifically linked to exploit attempts against the Fortigate VPN. Although no active exploitation or ransomware campaigns have been reported, reconnaissance is a critical early phase in the attack lifecycle that can lead to unauthorized access if successful. The absence of available patches for CVE-2023-27997 means organizations must rely on network monitoring, access restrictions, and configuration hardening to mitigate risk. Fortigate VPN appliances are widely deployed in enterprise, government, and critical infrastructure sectors, making this reconnaissance relevant globally. The CIRCL OSINT feed provides indicators of compromise (IOCs) including IP addresses for detection and blocking. The threat intelligence underscores the importance of early detection and proactive defense to prevent exploitation. The source rates the severity as low, but the overall risk considering the vulnerability and reconnaissance activity is medium.

If exploited, CVE-2023-27997 could allow attackers to bypass authentication on Fortigate VPN appliances, granting unauthorized access to internal corporate networks. This unauthorized access could lead to data exfiltration, lateral movement within networks, and disruption of critical services, impacting confidentiality, integrity, and availability. The immediate impact of the reconnaissance activity is low; however, successful exploitation could severely affect organizations relying on Fortigate VPN for secure remote access, including enterprises, government agencies, and critical infrastructure sectors. The lack of patches increases the risk, forcing reliance on detection and mitigation strategies. Sectors with high VPN usage such as finance, healthcare, and public administration are particularly vulnerable. The broad geographic distribution of scanning IPs suggests a wide targeting scope, potentially affecting multiple countries. The strategic importance of secure VPN access in hybrid work environments amplifies the threat. Failure to detect and respond to reconnaissance could enable attackers to exploit the vulnerability at scale, leading to significant operational and data security consequences.

1. Implement strict network segmentation to isolate Fortigate VPN appliances from general network traffic, minimizing exposure to scanning and exploitation attempts. 2. Deploy and maintain up-to-date intrusion detection and prevention systems (IDS/IPS) configured to detect scanning and exploitation attempts, using the provided IP indicators (e.g., 167.94.146.49, 206.168.34.198, 2001:470:1:c84::13) for blocking and alerting. 3. Continuously monitor VPN logs and network traffic for repeated or anomalous requests to /remote/logincheck and other sensitive endpoints to identify reconnaissance activity early. 4. Apply Fortinet's recommended security configurations and hardening guidelines, including disabling unnecessary services and enforcing strong authentication mechanisms such as multi-factor authentication (MFA). 5. Restrict access to VPN management interfaces to trusted IP addresses only, reducing the attack surface. 6. Conduct regular vulnerability assessments and penetration testing focused on VPN infrastructure to identify and remediate weaknesses proactively. 7. Establish and rehearse incident response procedures specifically addressing VPN-related threats to enable rapid containment and recovery. 8. Engage with Fortinet support and monitor security advisories to stay informed about any forthcoming patches or mitigations for CVE-2023-27997. 9. Educate network and security teams on reconnaissance indicators and the importance of early detection and response. 10. Consider deploying web application firewalls (WAF) or reverse proxies to filter and block malicious requests targeting VPN endpoints.