UnknownPublished 1 May 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-05-01

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2023-27997

Description

KRVTZ-NET IDS alerts for 2026-05-01

Impact

The impact is limited to reconnaissance activity targeting Fortigate VPN infrastructure. There is no evidence of successful exploitation or active attacks related to this observation. No known exploits in the wild or ransomware campaigns are linked to this activity. The low severity rating reflects the preliminary nature of the network scanning without confirmed compromise or damage.

Defensive guidance

No specific mitigation or patch is provided by the source for this observation. Since this is reconnaissance activity without confirmed exploitation, no immediate action is mandated. Organizations using Fortigate VPN devices should ensure their systems are updated according to Fortinet advisories for CVE-2023-27997. Monitoring for suspicious login attempts and unusual network activity targeting the /remote/logincheck endpoint is recommended.

Indicators of compromise

IP addresses 2

2001:470:1:c84::11ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
43.164.0.21ET USER_AGENTS User-Agent (_TEST_)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 8 May 2026, 02:21 UTC

Indicators of compromise

IP addresses 2

Community reviews

Related threats