Security Advisory

CVE-2023-27997: FortiOS SSL-VPN Heap Overflow

Last updated:
  • CVE-2023-27997

CVE-2023-27997, publicly nicknamed "XORtigate", is a heap-based buffer overflow in the SSL-VPN component of Fortinet FortiOS and FortiProxy that lets a remote, unauthenticated attacker execute arbitrary code or commands via a crafted request, and it was added to CISA's KEV catalog the day after Fortinet's advisory, with the catalog recording known ransomware campaign use.

Vulnerability summary

CVSS base score

9.8

Critical severity

EPSS score (FIRST)

85.7%

Probability of exploitation in the wild in the next 30 days

CISA KEV catalog

Yes

Listed as known exploited

Published

Vulnerability ID: CVE-2023-27997 · Source: NVD

Affected components

ComponentCPEVersion range
Fortinet FortiOScpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*6.0.0 through 6.0.16 (fixed in 6.0.17); 6.2.0 through 6.2.13 (fixed in 6.2.14); 6.4.0 through 6.4.12 (fixed in 6.4.13); 7.0.0 through 7.0.11 (fixed in 7.0.12); 7.2.0 through 7.2.4 (fixed in 7.2.5); 7.4 not affected
Fortinet FortiProxycpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*1.1.0 through 1.1.6, 1.2.0 through 1.2.13 (all versions vulnerable); 2.0.0 through 2.0.12 (fixed in 2.0.13); 7.0.0 through 7.0.9 (fixed in 7.0.10); 7.2.0 through 7.2.3 (fixed in 7.2.4)
Fortinet FortiOS on FortiGate 6000/7000 series hardwarecpe:2.3:o:fortinet:fortios-6k7k:*:*:*:*:*:*:*:*Selected 6.0.x, 6.2.x, 6.4.x and 7.0.x builds (per NVD's AND-node CPE configuration) are vulnerable only on FortiGate 6000/7000 series hardware; the same builds are unaffected on other hardware

What does this mean for affected devices?

CVE-2023-27997 is a heap-based buffer overflow (tracked by NVD as CWE-787, by the Fortinet CNA as CWE-122) in the SSL-VPN component of FortiOS and FortiProxy. A remote attacker who can reach the SSL-VPN interface, without needing any credentials, can send a specially crafted request that overflows a heap buffer, leading to execution of arbitrary code or commands on the device (NVD).

NVD's primary analysis and Fortinet's own PSIRT-submitted score agree: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, high impact to confidentiality, integrity and availability (NVD).

Fortinet's PSIRT advisory FG-IR-23-097, "Heap buffer overflow in sslvpn pre-authentication", lists the FortiOS and FortiProxy builds above as affected (plus a narrower set of builds that are only vulnerable on FortiGate 6000/7000 series hardware), gives the corresponding fixed releases, and recommends disabling SSL-VPN as a workaround for devices that cannot be patched immediately. At the time of that advisory's publication (2023-06-12), Fortinet stated there was no known exploitation in the wild yet (Fortinet PSIRT Advisory FG-IR-23-097).

That changed within a day: CISA added CVE-2023-27997 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-06-13, with a due date of 2023-07-04, and the catalog's "Known To Be Used in Ransomware Campaigns" field for this CVE now reads "Known" (CISA KEV).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.85689 (99.726th percentile), consistent with a critical, unauthenticated, pre-patch SSL-VPN RCE that continues to be scanned and exploited years after disclosure (FIRST EPSS).

Because this is a pre-authentication RCE with confirmed in-the-wild and ransomware use, any FortiOS or FortiProxy device on an affected build with SSL-VPN enabled should be upgraded to a fixed release immediately (or have SSL-VPN disabled in the interim) and checked for signs of prior compromise.

How to fix this class of issueThis advisory's weakness class is Memory corruption. Our practical guide covers how to detect, fix, verify and disclose it: How to fix memory corruption in embedded firmware.

Evidence

  • Heap-based buffer overflow in the SSL-VPN component of FortiOS/FortiProxy allows a remote, unauthenticated attacker to execute arbitrary code or commands via a crafted request. — NVD
  • CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD and the Fortinet PSIRT submission. — NVD
  • Affected FortiOS 6.0.0-6.0.16, 6.2.0-6.2.13, 6.4.0-6.4.12, 7.0.0-7.0.11, 7.2.0-7.2.4 (7.4 unaffected) and FortiProxy 1.1.x/1.2.x (all), 2.0.0-2.0.12, 7.0.0-7.0.9, 7.2.0-7.2.3; a subset of builds is vulnerable only on FortiGate 6000/7000 hardware. Disabling SSL-VPN is the stated workaround; no known exploitation reported as of the 2023-06-12 advisory. — Fortinet PSIRT Advisory FG-IR-23-097
  • Added to the CISA Known Exploited Vulnerabilities catalog on 2023-06-13 (one day after the vendor advisory), due date 2023-07-04; "Known To Be Used in Ransomware Campaigns" field reads "Known". — CISA KEV
  • EPSS score is 0.85689 (99.726th percentile) as of 2026-10-20. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportChat with David on WhatsApp

Related advisories

CVE-2023-4863: libwebp Heap Buffer Overflow Bundled in Mitsubishi Electric GENESIS64/ICONICS Suite — CVSS 8.8, High severityCISA KEVCVE-2023-4863: KEV heap buffer overflow in libwebp, bundled in Mitsubishi Electric GENESIS64 and ICONICS Suite SCADA/HMI products. Versions, fix, scoring, sourced to NVD, CISA KEV and CISA ICS advisory.CVE-2024-12248: Contec CMS8000 Patient Monitor Out-of-Bounds Write Enables Remote Code ExecutionCVE-2024-12248: a remote attacker can send specially formatted UDP requests to Contec Health's CMS8000 patient monitor to write arbitrary data out of bounds, which CISA assesses could lead to remote code execution. NVD has not, as of 2026-11-08, published its own Primary CVSS score; CISA's ICS-CERT Secondary rating is 9.8 (critical).CVE-2024-21762: Fortinet FortiOS SSL-VPN RCE — CVSS 9.8, Critical severityCISA KEVCVE-2024-21762: KEV out-of-bounds write in FortiOS/FortiProxy SSL-VPN, unauthenticated RCE. Versions, patches, scoring, sourced to NVD, CISA and Fortinet.

Sources

  1. NVD
  2. CISA KEV
  3. Fortinet PSIRT Advisory FG-IR-23-097
  4. FIRST EPSS

Frequently asked questions

Where does the nickname 'XORtigate' for CVE-2023-27997 come from?

The CVE is publicly nicknamed "XORtigate" by the security research community, referencing the Fortinet product line it affects and the obfuscation involved in the underlying heap-overflow mechanics; the CVE itself is tracked by NVD as CWE-787 and by Fortinet's own CNA submission as CWE-122 (per NVD).

Was CVE-2023-27997 already being exploited when Fortinet first published its advisory?

No — Fortinet's PSIRT advisory FG-IR-23-097, published 2023-06-12, stated there was no known exploitation in the wild at that time. That changed within a day, and the CISA KEV catalog now records this CVE's "Known To Be Used in Ransomware Campaigns" field as "Known" (per Fortinet PSIRT Advisory FG-IR-23-097; per CISA KEV).

What can be done on a FortiOS device that can't be patched right away?

Fortinet's advisory recommends disabling SSL-VPN as a workaround for devices that cannot be patched immediately, since the flaw lives specifically in the SSL-VPN component (per Fortinet PSIRT Advisory FG-IR-23-097).

How quickly did CISA add CVE-2023-27997 to its Known Exploited Vulnerabilities catalog?

CISA added it on 2023-06-13, one day after Fortinet's advisory, with a required-action due date of 2023-07-04 (per CISA KEV).

How likely is an unpatched FortiOS SSL-VPN to be targeted today?

FIRST's EPSS model scores the probability of exploitation at 0.85689 — the 99.726th percentile — as of 2026-10-20, consistent with a critical, pre-authentication RCE that continues to be scanned and exploited years after disclosure (per FIRST EPSS).

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp