UnknownPublished 9 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-09

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-04-09

Impact

The impact is currently low as the observed activity represents reconnaissance without confirmed exploitation or system compromise. No known exploits in the wild have been reported in this feed. While reconnaissance could precede exploitation attempts, this report does not indicate active attacks or breaches.

Defensive guidance

Since this report does not provide specific mitigation steps, monitoring vendor updates and applying recommended patches or workarounds as they become available is advised.

Summary

The threat involves network reconnaissance activity detected by IDS alerts, characterized by repeated GET requests to the /remote/logincheck endpoint on Fortigate VPN devices. This behavior is linked to CVE-2023-27997, a vulnerability in Fortigate VPN. The report does not specify affected versions or active exploitation. Patch availability is not confirmed here, and no known exploits in the wild are reported. The activity is considered low severity and indicative of reconnaissance rather than active attack or compromise.

Indicators of compromise

IP addresses 2

ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)

2001:470:2cc:1:451e:14ef:afd5:9f58
64.62.197.77

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:26 UTC

Indicators of compromise

IP addresses 2

Community reviews

Related threats