[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How to Respond: CVE-2023-27997 (Fortigate SSL VPN)](/blog/how-to-respond-cve-2023-27997) Publish date January 7, 2025 {x} minute read # How to Respond: CVE-2023-27997 (Fortigate SSL VPN) [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Steve Harrison](/team/steve-harrison) Vice President, Product Support Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) A critical vulnerability in FortiGate SSL VPN could allow hackers to access vulnerable systems and inject malicious code, even if Multi-Factor Authentication (MFA) is enabled. To learn how to identify whether your Fortinet product is impacted and how to quickly secure it, read on. [Learn how UpGuard simplifies Vendor Risk Management >](https://www.upguard.com/product/vendorrisk) ## What is CVE-2023-27997 CVE-2023-27997 is a critical heap buffer overflow vulnerability in the SSL-VPN pre-authentication module of Fortinet's FortiOS. Its exploitation allows excess data to overflow from an allocated memory block into adjacent memory blocks in the heap, making it possible to execute arbitrary code enforcing malicious program behavior.  ‍ SSL VPNs are often trusted to facilitate secure connections to private organization networks. A vulnerability like CVE-2023-27997 could allow cybercriminals to access any networks and products protected by this secure channel. What elevates this vulnerability to a critical severity is the fact that it can be exploited pre-authentication, meaning cybercriminals could exploit it without providing privileged credentials. With the resulting significant compression of the cyber attack pathway, [indicators of Attack](https://www.upguard.com/blog/what-are-indicators-of-attack#toc-0) are much harder to detect and intercept, giving all data breach attempts a higher likelihood of success.  ‍[Learn how to respond to the MOVEit zero-day >](https://www.upguard.com/blog/the-moveit-0-day) ## How to Detect CVE-2023-27997 You can determine whether they are impacted by the FortiGate SSL VPN by comparing their product version number against the following vulnerable FortiOS versions. * FortiOS-6K7K version 7.0.12 or above * FortiOS-6K7K version 6.4.13 or above * FortiOS-6K7K version 6.2.15 or above * FortiOS-6K7K version 6.0.17 or above * FortiProxy version 7.2.4 or above * FortiProxy version 7.0.10 or above * FortiProxy version 2.0.13 or above * FortiOS version 7.4.0 or above * FortiOS version 7.2.5 or above * FortiOS version 7.0.12 or above * FortiOS version 6.4.13 or above * FortiOS version 6.2.14 or above, and * FortiOS version 6.0.17 or above To check the version of your FortiOS product, type the following command in your Command Line Interface. > diagnose sys fortiguard-service status ### How UpGuard Can Help Although security teams are expected to rapidly patch such critical vulnerabilities, impacted environments could still be overlooked, especially if they're associated with** **unmaintained [internet-facing assets](https://www.upguard.com/blog/detecting-internet-facing-assets). Using ethical non-invasive scanning techniques, UpGuard can detect instances of a FortiOS SSL VPN interface. See the example below of this risk being detected in a user's Vendor's Risk profile. Because invasive scanning methods violate UpGuard's scanning policy, the quickest (and most ethical) method of confirming vulnerable instances of FortiOS is to send a remediation request asking for security patch confirmation. Watch the video below to learn how UpGuard can detect unmaintained assets likely running vulnerable software versions. [Get a free trial of UpGuard >](https://www.upguard.com/demo) ## Impact Mitigation Suggestions for the Fortigate SSL VPN Vulnerability Follow these suggested response actions to mitigate the impact of CVE-2023-27997. ### 1. Upgrade to the Latest FortiOS Firmware Release Upgrade your firmware to the following patched versions of FortiOS-6k7k, FortiProxy, and FortiOS:  **FortiOS-6K7K** * Version 7.0.12 or above * Version 6.4.13 or above * Version 6.2.15 or above * Version 6.0.17 or above **FortiProxy** * Version 7.2.4 or above * Version 7.0.10 or above **FortiOS** * Version 7.4.0 or above * Version 7.2.5 or above * Version 7.0.12 or above * Version 6.4.13 or above * Version 6.2.14 or above * Version 6.0.17 or above > Be sure to follow your organizational patching policy to minimize business operation disruption during firmware upgrades.  ### 2. Disable SSL-VPN on all Impacted Devices Upgrading to the latest patched versions of Fortinet is the best form of defense against CVE-2023-27997. However, for instances where patching isn't an option, all SSL-VPN appliances should be immediately disabled - even if you haven't confirmed whether they're running vulnerable software versions. For instructions on how to disable all SSL VPN connections, [refer to this Fotinet document](https://docs.fortinet.com/document/fortigate/7.2.2/ssl-vpn-to-ztna-migration-guide/31722/shut-off-all-ssl-vpn-access). Successful disablement is confirmed when the Remote Access module is no longer visible on all workstations connected to the EMS. ### 3. Follow FortiOS Hardening Guidelines After upgrading to the latest patched versions, your attack surface should be further reduced by [following this hardening guide by Fortinet](https://docs.fortinet.com/document/fortigate/7.2.0/best-practices/555436/hardening). Forinet's hardening guide reduces the risk of data breaches by outlining best practices in the following areas: * Physical security * Vulnerability - monitoring PSIRT * Firmware * Encrypted protocols * FortiGuard databases * Penetration testing * Denial of service * Secure password storage eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Learn about two critical vulnerabilities affecting the ServiceNow platform (CVE-2024-4789 and CVE-2024-5217) and how UpGuard can help. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) January 16, 2025 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 22, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)