The threat intelligence feed reports network activity indicative of reconnaissance or exploitation attempts targeting Fortigate VPN devices via repeated GET requests to the /remote/logincheck endpoint. This activity corresponds to CVE-2023-27997, a known vulnerability in Fortigate VPN. The alert is categorized as low severity and is based on IDS detection of suspicious traffic from the IP address 2001:470:1:fb5::2c0. No affected product versions or patch information are provided in this alert.

The impact is currently assessed as low based on the alert severity and the absence of known exploits in the wild. The activity suggests reconnaissance or preliminary exploitation attempts but does not confirm successful compromise or active exploitation campaigns.

Patch status is not yet confirmed — check the Fortinet vendor advisory for CVE-2023-27997 for current remediation guidance. Since this alert does not provide specific mitigation steps, organizations should verify their Fortigate VPN devices are updated according to the latest official Fortinet security advisories. Monitoring for unusual login attempts and applying vendor-recommended patches remain best practices.