CVE-2023-27997: FortiOS SSL-VPN Heap Overflow
CVE-2023-27997, publicly nicknamed "XORtigate", is a heap-based buffer overflow in the SSL-VPN component of Fortinet FortiOS and FortiProxy that lets a remote, unauthenticated attacker execute arbitrary code or commands via a crafted request, and it was added to CISA's KEV catalog the day after Fortinet's advisory, with the catalog recording known ransomware campaign use.
Vulnerability summary
| Vulnerability ID | CVE-2023-27997 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.85689 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2023-06-13T09:15:16.613 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Fortinet FortiOS | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* | 6.0.0 through 6.0.16 (fixed in 6.0.17); 6.2.0 through 6.2.13 (fixed in 6.2.14); 6.4.0 through 6.4.12 (fixed in 6.4.13); 7.0.0 through 7.0.11 (fixed in 7.0.12); 7.2.0 through 7.2.4 (fixed in 7.2.5); 7.4 not affected |
| Fortinet FortiProxy | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | 1.1.0 through 1.1.6, 1.2.0 through 1.2.13 (all versions vulnerable); 2.0.0 through 2.0.12 (fixed in 2.0.13); 7.0.0 through 7.0.9 (fixed in 7.0.10); 7.2.0 through 7.2.3 (fixed in 7.2.4) |
| Fortinet FortiOS on FortiGate 6000/7000 series hardware | cpe:2.3:o:fortinet:fortios-6k7k:*:*:*:*:*:*:*:* | Selected 6.0.x, 6.2.x, 6.4.x and 7.0.x builds (per NVD's AND-node CPE configuration) are vulnerable only on FortiGate 6000/7000 series hardware; the same builds are unaffected on other hardware |
What this means
CVE-2023-27997 is a heap-based buffer overflow (tracked by NVD as CWE-787, by the Fortinet CNA as CWE-122) in the SSL-VPN component of FortiOS and FortiProxy. A remote attacker who can reach the SSL-VPN interface, without needing any credentials, can send a specially crafted request that overflows a heap buffer, leading to execution of arbitrary code or commands on the device (NVD).
NVD's primary analysis and Fortinet's own PSIRT-submitted score agree: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, high impact to confidentiality, integrity and availability (NVD).
Fortinet's PSIRT advisory FG-IR-23-097, "Heap buffer overflow in sslvpn pre-authentication", lists the FortiOS and FortiProxy builds above as affected (plus a narrower set of builds that are only vulnerable on FortiGate 6000/7000 series hardware), gives the corresponding fixed releases, and recommends disabling SSL-VPN as a workaround for devices that cannot be patched immediately. At the time of that advisory's publication (2023-06-12), Fortinet stated there was no known exploitation in the wild yet (Fortinet PSIRT Advisory FG-IR-23-097).
That changed within a day: CISA added CVE-2023-27997 to the Known Exploited Vulnerabilities (KEV) catalog on 2023-06-13, with a due date of 2023-07-04, and the catalog's "Known To Be Used in Ransomware Campaigns" field for this CVE now reads "Known" (CISA KEV).
As of 2026-10-20, FIRST scores the probability of exploitation at 0.85689 (99.726th percentile), consistent with a critical, unauthenticated, pre-patch SSL-VPN RCE that continues to be scanned and exploited years after disclosure (FIRST EPSS).
Because this is a pre-authentication RCE with confirmed in-the-wild and ransomware use, any FortiOS or FortiProxy device on an affected build with SSL-VPN enabled should be upgraded to a fixed release immediately (or have SSL-VPN disabled in the interim) and checked for signs of prior compromise.
Evidence
- Heap-based buffer overflow in the SSL-VPN component of FortiOS/FortiProxy allows a remote, unauthenticated attacker to execute arbitrary code or commands via a crafted request. — NVD
- CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD and the Fortinet PSIRT submission. — NVD
- Affected FortiOS 6.0.0-6.0.16, 6.2.0-6.2.13, 6.4.0-6.4.12, 7.0.0-7.0.11, 7.2.0-7.2.4 (7.4 unaffected) and FortiProxy 1.1.x/1.2.x (all), 2.0.0-2.0.12, 7.0.0-7.0.9, 7.2.0-7.2.3; a subset of builds is vulnerable only on FortiGate 6000/7000 hardware. Disabling SSL-VPN is the stated workaround; no known exploitation reported as of the 2023-06-12 advisory. — Fortinet PSIRT Advisory FG-IR-23-097
- Added to the CISA Known Exploited Vulnerabilities catalog on 2023-06-13 (one day after the vendor advisory), due date 2023-07-04; "Known To Be Used in Ransomware Campaigns" field reads "Known". — CISA KEV
- EPSS score is 0.85689 (99.726th percentile) as of 2026-10-20. — FIRST EPSS