The threat involves network reconnaissance activity detected by IDS alerts, characterized by repeated GET requests to the /remote/logincheck endpoint on Fortigate VPN devices. This behavior is linked to CVE-2023-27997, a vulnerability in Fortigate VPN. The report does not specify affected versions or active exploitation. Patch availability is not confirmed here, and no known exploits in the wild are reported. The activity is considered low severity and indicative of reconnaissance rather than active attack or compromise.

The impact is currently low as the observed activity represents reconnaissance without confirmed exploitation or system compromise. No known exploits in the wild have been reported in this feed. While reconnaissance could precede exploitation attempts, this report does not indicate active attacks or breaches.

Patch status is not yet confirmed—organizations should consult Fortinet's official vendor advisories for current remediation guidance on CVE-2023-27997. Since this report does not provide specific mitigation steps, monitoring vendor updates and applying recommended patches or workarounds as they become available is advised.