UnknownPublished 19 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-19

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-04-19

Impact

The impact is assessed as low based on the report's severity rating. The activity represents reconnaissance or exploitation attempts against Fortigate VPN devices but lacks confirmation of successful exploitation or widespread impact. No known exploits in the wild are reported, indicating limited immediate risk from this specific alert.

Defensive guidance

No specific mitigation instructions are provided in this report.

Summary

The report from CIRCL OSINT Feed details IDS alerts capturing repeated GET requests to the /remote/logincheck endpoint on Fortigate VPN devices, consistent with reconnaissance or exploitation attempts targeting CVE-2023-27997. The data does not specify affected versions or confirm exploitation success. Patch availability is not indicated in this report, and no known exploits in the wild have been reported. The activity is classified as low severity and categorized as reconnaissance network activity. The source IP involved is 64.62.197.167.

Indicators of compromise

IP addresses 1

ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)

64.62.197.167

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:23 UTC

Indicators of compromise

IP addresses 1

Community reviews

Related threats