UnknownPublished 28 Apr 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-04-28

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-04-28

Impact

The impact is currently low as the alerts primarily indicate reconnaissance and scanning activities without confirmed exploitation or active attacks. The presence of requests related to CVE-2023-27997 suggests potential probing for a known Fortigate VPN vulnerability, but no known exploits in the wild are reported. No direct compromise, data loss, or service disruption is indicated by the data.

Defensive guidance

No specific patch or mitigation is provided in the source data. Organizations should verify that Fortigate VPN systems are updated according to the latest vendor advisories addressing CVE-2023-27997. Monitoring for suspicious inbound requests matching these indicators, especially attempts to access hidden environment files and .htpasswd files, is recommended.

Indicators of compromise

IP addresses 8

57.154.243.43ET INFO Request to Hidden Environment File - Inbound
5.255.102.136ET INFO Request to Hidden Environment File - Inbound
64.62.197.227ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
2a03:cfc0:8000:2e::9532:7419ET WEB_SERVER Possible SQLi Attempt in User Agent (Inbound)
185.177.72.16ET INFO Request to Hidden Environment File - Inbound
145.223.45.151ET SCAN Exabot Webcrawler User Agent
94.177.49.254ET SCAN Exabot Webcrawler User Agent
195.178.110.101GPL WEB_SERVER .htpasswd access

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:21 UTC

Indicators of compromise

IP addresses 8

Community reviews

Related threats