UnknownPublished 17 May 2026

tlp clear · KRVTZ-NET IDS alerts for 2026-05-17

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Mentions 2 CVEs

Mentioned vulnerabilities

Description

The KRVTZ-NET IDS alerts for 2026-05-17 report multiple network reconnaissance and scanning activities, including repeated exploit attempts against Fortigate VPN (CVE-2023-27997) and a React Server Components vulnerability (CVE-2025-55182). Several IP addresses were observed making suspicious requests such as repeated GET requests to /remote/logincheck and attempts to access hidden environment files. These activities are indicative of preliminary probing rather than confirmed exploitation. No known exploits in the wild or confirmed breaches have been reported. The overall severity is assessed as low due to the absence of confirmed successful attacks.

Impact

The impact is currently limited to reconnaissance and potential exploit attempts without evidence of successful exploitation or compromise. The presence of repeated exploit attempts against known vulnerabilities suggests targeting of Fortigate VPN and React Server Components, but no active breaches or ransomware campaigns have been confirmed. The low severity rating reflects the preliminary nature of these alerts and the lack of confirmed malicious outcomes.

Defensive guidance

Organizations using Fortigate VPN and React Server Components should ensure their systems are updated according to vendor advisories for CVE-2023-27997 and CVE-2025-55182, respectively. No urgent action is required based on this alert alone.

Summary

This threat intelligence report details IDS alerts capturing network reconnaissance and potential exploit attempts on 2026-05-17. Notably, multiple IP addresses were detected performing repeated GET requests targeting the Fortigate VPN logincheck endpoint, associated with CVE-2023-27997, a known vulnerability. Additionally, an IP was observed attempting to exploit a React Server Components vulnerability (CVE-2025-55182) related to unsafe Flight Protocol property access. Other indicators include requests to hidden environment files and suspicious user-agent strings, typical of scanning or probing activity.

Indicators of compromise

IP addresses 18

2602:fb54:1a00::50ET INFO Request to Hidden Environment File - Inbound
43.153.26.165ET USER_AGENTS User-Agent (_TEST_)
43.130.116.87ET USER_AGENTS User-Agent (_TEST_)
64.62.156.66ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
2001:470:1:c84::17ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
103.153.183.126ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)
2001:470:2cc:1::15fET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
43.155.26.193ET USER_AGENTS User-Agent (_TEST_)
74.82.47.5ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)
43.165.65.117ET USER_AGENTS User-Agent (_TEST_)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 May 2026, 19:33 UTC

Indicators of compromise

IP addresses 18

Community reviews

Related threats