This threat involves network reconnaissance detected by KRVTZ-NET IDS on February 26, 2026, targeting Fortinet FortiGate VPN devices. The reconnaissance consists of repeated GET requests to the /remote/logincheck endpoint, linked to CVE-2023-27997, a known vulnerability that could allow attackers to bypass authentication controls. The indicators include IPv6 addresses 2001:470:1:c84::19 and 2001:470:1:fb5:4709:6cd5:858c:48d, and IPv4 address 185.177.72.60, which show suspicious user-agent strings indicative of automated scanning tools. No patches or exploits in the wild are currently reported in this feed. The activity is categorized as reconnaissance in the cyber kill chain, signaling early-stage probing rather than active exploitation. The threat affects multiple countries globally and is rated low severity due to the absence of confirmed exploitation.

If CVE-2023-27997 were exploited, attackers could bypass authentication on FortiGate VPN devices, potentially gaining unauthorized access to internal networks. This could lead to data breaches, lateral movement, and compromise of sensitive information. The reconnaissance activity increases the likelihood of exploitation if devices remain unpatched or misconfigured. Critical sectors relying on FortiGate VPNs for remote access could be at risk. However, no active exploitation or known exploits in the wild have been confirmed at this time, and the current impact is limited to scanning and information gathering.

No official patch is confirmed in this report; patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Organizations should verify and apply any available patches for CVE-2023-27997 on FortiGate VPN devices. In the absence of patches, implement compensating controls such as multi-factor authentication for VPN access. Monitor VPN logs and IDS alerts for repeated or anomalous requests to /remote/logincheck and suspicious user-agent strings. Consider rate limiting, geo-blocking, or IP reputation filtering to reduce scanning attempts. Regular vulnerability assessments and penetration testing focused on VPN infrastructure are recommended. Subscribe to threat intelligence feeds for timely updates and update incident response plans to include FortiGate VPN exploitation scenarios.