UnknownPublished 26 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-26

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-04-26

Impact

The impact is limited to reconnaissance and scanning activity with potential attempts to exploit the Fortigate VPN vulnerability CVE-2023-27997. There is no indication of confirmed exploitation or active compromise. The threat is currently low severity and functions as an early warning of scanning and probing behavior targeting Fortigate VPN devices.

Defensive guidance

Since no active exploitation is confirmed and patch availability is false, organizations should verify their Fortigate VPN devices are updated according to vendor advisories for CVE-2023-27997. Monitoring for suspicious repeated GET requests to /remote/logincheck is advisable. No urgent action is required based on this alert alone.

Indicators of compromise

IP addresses 3

103.215.74.213ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan
2001:470:2cc:1::29fET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
64.62.156.108ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:22 UTC

Indicators of compromise

IP addresses 3

Community reviews

Related threats