Fortigate VPN Exploit Attempt via CVE-2023-27997 and Suspicious User-Agent
Multiple IDS alerts indicate potential exploitation attempts against Fortigate VPN servers using CVE-2023-27997, alongside traffic from a suspicious user agent, possibly indicating reconnaissance or exploit activity.
On February 26, 2026, network intrusion detection systems (IDS) triggered alerts related to potential exploitation attempts targeting Fortigate VPN servers. The alerts highlight suspicious network activity originating from multiple IP addresses, specifically repeated GET requests to the /remote/logincheck endpoint, a known vulnerability associated with CVE-2023-27997. This vulnerability could allow unauthorized access to the VPN. Additionally, an IPv4 address was observed using a suspicious…
Detection coverage 3
Detect Fortigate CVE-2023-27997 Exploitation Attempt
highDetects repeated GET requests to /remote/logincheck, indicating a potential CVE-2023-27997 exploitation attempt.
Detect Suspicious User-Agent
mediumDetects connections using the suspicious User-Agent string observed in the alerts.
Detect Fortigate VPN Login Check Request
infoDetects requests to the Fortigate VPN login check page.
Detection queries are kept inside the platform. Get full rules →
Indicators of compromise
3
ip