This report details IDS alerts from KRVTZ-NET on 2026-04-26 highlighting network activity involving suspicious scanning and repeated GET requests to the /remote/logincheck endpoint of Fortigate VPN devices, associated with CVE-2023-27997. The indicators include IP addresses flagged for scanning and exploit attempts. There is no confirmation of successful exploitation or active compromise. Patch availability is indicated as false, and no known exploits are currently active in the wild. The report lacks specific affected versions and CVSS scoring, limiting detailed impact assessment.

The impact is limited to reconnaissance and scanning activity with potential attempts to exploit the Fortigate VPN vulnerability CVE-2023-27997. There is no indication of confirmed exploitation or active compromise. The threat is currently low severity and functions as an early warning of scanning and probing behavior targeting Fortigate VPN devices.

No official patch or remediation is indicated in this report. Since no active exploitation is confirmed and patch availability is false, organizations should verify their Fortigate VPN devices are updated according to vendor advisories for CVE-2023-27997. Monitoring for suspicious repeated GET requests to /remote/logincheck is advisable. No urgent action is required based on this alert alone.