The KRVTZ-NET IDS alerts for 2026-04-15 report multiple network activities indicative of reconnaissance. These include scanning for SFTP/FTP password exposures through sftp-config.json files and requests for Visual Studio Code sftp.json files, which may reveal sensitive configuration information. Additionally, there are repeated GET requests to the /remote/logincheck endpoint on Fortigate VPN devices, linked to CVE-2023-27997, a known vulnerability. The report does not provide patch or mitigation details and notes no known exploits actively used in the wild. The severity of these observations is low, and the activity appears to be preliminary information gathering rather than active exploitation.

The observed network activities suggest potential information leakage risks through exposed configuration files related to SFTP/FTP and Visual Studio Code. The repeated exploit attempts on Fortigate VPN devices could indicate attempts to leverage CVE-2023-27997, which may allow unauthorized access if successful. However, there are no reports of confirmed exploitation or active threat campaigns associated with these alerts. The impact is primarily reconnaissance and potential exposure of sensitive configuration data, which could be leveraged in later attack stages.

Patch status for the Fortigate VPN vulnerability (CVE-2023-27997) is not confirmed in this report; users should consult the Fortigate vendor advisory for current remediation guidance. No specific mitigation actions are provided for the observed reconnaissance activities. Organizations should verify that sensitive configuration files such as sftp-config.json and sftp.json are not publicly accessible and follow vendor recommendations for securing Fortigate VPN devices. Since no official patch or mitigation is stated here, checking vendor advisories is essential.