The KRVTZ-NET IDS alerts for 2026-05-08 capture various network activities including reconnaissance and scanning. Indicators include IP addresses associated with webcrawler user agents (Exabot, Naver), test user agents, and exploit attempts against Fortigate VPN using CVE-2023-27997. The exploit attempts involve repeated GET requests to the /remote/logincheck endpoint, which is known to be vulnerable in certain Fortigate VPN versions. The feed does not specify affected product versions or confirm active exploitation. No patch information is provided within this alert, and no known exploits in the wild are reported.

The impact is limited to reconnaissance and scanning activities with some exploit attempts against Fortigate VPN CVE-2023-27997. There is no evidence of successful exploitation or compromise. The activity may indicate preliminary probing by threat actors but does not confirm active attacks or breaches.

Patch status is not yet confirmed — check the Fortigate vendor advisory for CVE-2023-27997 for current remediation guidance. Since this alert primarily reports reconnaissance and scanning, organizations should verify that Fortigate VPN devices are updated with the latest security patches. No direct mitigation is provided in this alert. Monitoring for suspicious repeated requests to /remote/logincheck is recommended if Fortigate VPN is in use.