UpHeron
All vulnerabilities

Servers and applications

CVE-2023-27997

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 13 Jun 2023.

Severity
Critical 9.8
Published
13 Jun 2023
Last changed
31 Jul 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Fortinet FortiProxyServers and applications · cpe:a:fortinet:fortiproxy
  • From 1.1.0 up to 1.1.6
  • From 1.2.0 up to 1.2.13
  • From 2.0.0 up to 2.0.12
  • From 7.0.0 up to 7.0.9
  • From 7.2.0 up to 7.2.3
Fortinet FortiOSServers and applications · cpe:o:fortinet:fortios
  • From 7.2.0 up to 7.2.4
  • Version 7.0.10
  • Version 7.0.5
  • From 7.0.0 up to 7.0.11
All 18 release lines
  • From 6.0.0 up to 6.0.16
  • Version 6.0.10
  • From 6.0.12 up to 6.0.16
  • From 6.2.0 up to 6.2.13
  • Version 6.2.4
  • Version 6.2.6
  • Version 6.2.7
  • From 6.2.9 up to 6.2.13
  • From 6.4.0 up to 6.4.12
  • Version 6.4.2
  • Version 6.4.6
  • Version 6.4.8
  • Version 6.4.10
  • Version 6.4.12
  • From 7.0.0 up to 7.0.11
  • Version 7.0.5
  • Version 7.0.10
  • From 7.2.0 up to 7.2.4

Known exploited

CISA name
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
4 Jul 2023
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-27997
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-27997