This alert aggregates IDS detections from KRVTZ-NET on 2026-05-08, highlighting network reconnaissance and scanning activities. Indicators include IP addresses linked to webcrawler user agents and test user agents. Importantly, some IPs are observed performing repeated GET requests to the /remote/logincheck endpoint of Fortigate VPN devices, which is associated with CVE-2023-27997, a known vulnerability. The alert does not provide details on affected Fortigate versions or confirm active exploitation. No patch information or vendor advisory is included in this alert, and no active exploitation in the wild is reported.

The impact is limited to reconnaissance and scanning activities with some exploit attempts against Fortigate VPN devices vulnerable to CVE-2023-27997. There is no evidence within this alert of successful exploitation or system compromise. The activity may represent preliminary probing by threat actors but does not confirm active attacks or breaches.

Patch status is not yet confirmed — check the Fortigate vendor advisory for CVE-2023-27997 for current remediation guidance. Organizations using Fortigate VPN should verify their devices are updated with the latest security patches. Since this alert primarily reports reconnaissance and scanning, monitoring for suspicious repeated requests to the /remote/logincheck endpoint is recommended if Fortigate VPN is deployed. No direct mitigation is provided in this alert.