{"schemaVersion":3,"id":"CVE-2023-27997","aliases":[],"status":"published","duplicateOf":null,"title":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","description":"A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.","dates":{"published":"2023-06-13T08:41:47.415Z","modified":"2026-07-31T03:55:27.798Z","reserved":null,"kevAdded":["2023-06-13T00:00:00.000Z","2025-01-23T00:00:00.000Z"],"kevDue":["2023-07-04T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.2,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:R","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.85689,"percentile":0.99727,"severity":"critical","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.85689},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.85689,"percentile":0.99727}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.85689,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.85689,"percentile":0.99727}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-06-13T00:00:00.000Z","dueDate":"2023-07-04T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","description":"Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.","notes":[{"type":"url","href":"https://www.fortiguard.com/psirt/FG-IR-23-097","label":"www.fortiguard.com/psirt/FG-IR-23-097"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-27997","label":"nvd.nist.gov/vuln/detail/CVE-2023-27997"}],"vendor":"Fortinet","product":"FortiOS and FortiProxy SSL-VPN","ransomware":true,"ransomwareUse":"Known","exploitationType":null},{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2025-01-23T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"Heap-based buffer overflow vulnerability may allow remote attackers to execute arbitrary code or commands","notes":[],"vendor":"Fortinet","product":"FortiOS and FortiProxy","ransomware":true,"ransomwareUse":"Known","exploitationType":"ransomware"}],"listedCount":2,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-06-13T00:00:00.000Z","dueDate":"2023-07-04T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","description":"Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.","notes":[{"type":"url","href":"https://www.fortiguard.com/psirt/FG-IR-23-097","label":"www.fortiguard.com/psirt/FG-IR-23-097"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-27997","label":"nvd.nist.gov/vuln/detail/CVE-2023-27997"}],"vendor":"Fortinet","product":"FortiOS and FortiProxy SSL-VPN","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":true,"entry":{"source":"enisa","sourceLabel":"ENISA","dateAdded":"2025-01-23T00:00:00.000Z","dueDate":null,"requiredAction":null,"name":null,"description":"Heap-based buffer overflow vulnerability may allow remote attackers to execute arbitrary code or commands","notes":[],"vendor":"Fortinet","product":"FortiOS and FortiProxy","ransomware":true,"ransomwareUse":"Known","exploitationType":"ransomware"}},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa","enisa"]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-122","name":"Heap-based Buffer Overflow","description":"A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/122.html"},{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"fortinet","product":"fortios","name":"FortiOS","label":"fortios","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.0.0, ≤ 6.0.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.0, ≤ 6.2.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.4.0, ≤ 6.4.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.11","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.12, ≤ 6.0.16","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.9, ≤ 6.2.13","noFixRecorded":false,"fixedIn":null},{"text":"6.0.10","noFixRecorded":false,"fixedIn":null},{"text":"6.2.4","noFixRecorded":false,"fixedIn":null},{"text":"6.2.6","noFixRecorded":false,"fixedIn":null},{"text":"6.2.7","noFixRecorded":false,"fixedIn":null},{"text":"6.4.2","noFixRecorded":false,"fixedIn":null},{"text":"6.4.6","noFixRecorded":false,"fixedIn":null},{"text":"6.4.8","noFixRecorded":false,"fixedIn":null},{"text":"6.4.10","noFixRecorded":false,"fixedIn":null},{"text":"6.4.12","noFixRecorded":false,"fixedIn":null},{"text":"7.0.5","noFixRecorded":false,"fixedIn":null},{"text":"7.0.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.0.0, ≤ 6.0.16 | ≥ 6.2.0, ≤ 6.2.13 | ≥ 6.4.0, ≤ 6.4.12 | ≥ 7.0.0, ≤ 7.0.11 | ≥ 7.2.0, ≤ 7.2.4 | ≥ 6.0.12, ≤ 6.0.16 | ≥ 6.2.9, ≤ 6.2.13 | 6.0.10 | 6.2.4 | 6.2.6 | 6.2.7 | 6.4.2 | 6.4.6 | 6.4.8 | 6.4.10 | 6.4.12 | 7.0.5 | 7.0.10","eol":{"isEol":true,"eolDate":"2022-09-29T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"6.0","label":"6.0","eolFrom":"2022-09-29T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fortios","label":"FortiOS","category":"os"}},"hubHref":"/vendor/fortinet/fortios"},{"vendor":"fortinet","product":"fortios-6k7k","name":"fortios-6k7k","label":"fortios-6k7k","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.0.10","noFixRecorded":false,"fixedIn":null},{"text":"7.0.5","noFixRecorded":false,"fixedIn":null},{"text":"6.4.12","noFixRecorded":false,"fixedIn":null},{"text":"6.4.10","noFixRecorded":false,"fixedIn":null},{"text":"6.4.8","noFixRecorded":false,"fixedIn":null},{"text":"6.4.6","noFixRecorded":false,"fixedIn":null},{"text":"6.4.2","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.9, ≤ 6.2.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.2.6, ≤ 6.2.7","noFixRecorded":false,"fixedIn":null},{"text":"6.2.4","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.0.12, ≤ 6.0.16","noFixRecorded":false,"fixedIn":null},{"text":"6.0.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0.10 | 7.0.5 | 6.4.12 | 6.4.10 | 6.4.8 | 6.4.6 | 6.4.2 | ≥ 6.2.9, ≤ 6.2.13 | ≥ 6.2.6, ≤ 6.2.7 | 6.2.4 | ≥ 6.0.12, ≤ 6.0.16 | 6.0.10","eol":null,"hubHref":"/vendor/fortinet/fortios-6k7k"},{"vendor":"fortinet","product":"fortiproxy","name":"FortiProxy","label":"fortiproxy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.1.0, ≤ 1.1.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.2.0, ≤ 1.2.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 2.0.0, ≤ 2.0.12","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.9","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.1.0, ≤ 1.1.6 | ≥ 1.2.0, ≤ 1.2.13 | ≥ 2.0.0, ≤ 2.0.12 | ≥ 7.0.0, ≤ 7.0.9 | ≥ 7.2.0, ≤ 7.2.3","eol":null,"hubHref":"/vendor/fortinet/fortiproxy"}],"affectedCount":3,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-097","label":"fortiguard.com/psirt/FG-IR-23-097","hostname":"fortiguard.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27997","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-06-13T08:41:47.415Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2023-06-13T00:00:00.000Z","label":"Added to CISA KEV","detail":"Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2023-07-04T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"kev-added","date":"2025-01-23T00:00:00.000Z","label":"Added to ENISA KEV","detail":"Added to the ENISA known exploited vulnerabilities catalog.","source":"enisa"},{"kind":"modified","date":"2026-07-31T03:55:27.798Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T14:32:43.093Z","stale":false,"partial":false}}