---
title: Pre-Authentication Critical Vulnerability in Fortinet SSL VPN
description: CVE-2023-27997 Critical Remote Code Execution (RCE) vulnerability in Fortinet SSL VPN appliances. Remediation and resources by PacketWatch Threat Intel
---

[Cyber Threat Intelligence | PacketWatch ](https://packetwatch.com/resources/threat-intel)

# [Pre-Authentication Critical Vulnerability in Fortinet SSL VPN](https://packetwatch.com/resources/threat-intel/pre-authentication-critical-vulnerability-in-fortinet-ssl-vpn)

 Written by [PacketWatch Team Sixty43](https://packetwatch.com/resources/threat-intel/author/the-packetwatch-intelligence-team) | June 12, 2023

On Friday, June 9, 2023, Fortinet released new firmware updates for FortiOS. Over the weekend, security researchers shared on social media that this firmware update remediates a critical RCE vulnerability in the Fortinet SSL VPN devices.

Last Updated: June 12, 2023 at 3:08 PM MST

The official Fortinet Product Security Incident Response Team (PSIRT) blog [stated](https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign): "Our investigation found that one issue ([FG-IR-23-097](https://www.fortiguard.com/psirt/FG-IR-23-097)) may have been exploited in a limited number of cases and we are working closely with customers to monitor the situation."

They also provided clarifications on the Volt Typhoon Campaign.

Today, security researcher [Charles Fol](https://twitter.com/cfreal_) from Lexfo Security confirmed the security update includes a fix for the RCE vulnerability and that he and another ‘[Rioru](https://twitter.com/DDXhunter)’ discovered.

However, Charles stated on his Twitter feed that the vulnerability affects all Fortinet SSL VPN appliances, and the vulnerability is “reachable pre-authentication”, meaning no credentials are required to exploit the vulnerable systems.  

An additional security advisory from [Olympe Cyberdefense](https://olympecyberdefense.fr/1193-2/) also states that the vulnerability will work even if multi-factor authentication (MFA) is enabled.

Administrators are strongly encouraged to patch vulnerable devices immediately.

# CVE-2023-27997

Critical Remote Code Execution (RCE) vulnerability in Fortinet SSL VPN appliances

### Affected Products

All Fortinet SSL VPN appliances

### Remediation

Upgrade to the latest FortiOS firmware versions released by Fortinet:

`6.0.17`

`6.2.15`

`6.4.13`

`7.0.12`

`7.2.5`

#### Resources

- [Fortigate PSIRT Advisory: FortiOS & FortiProxy - Heap buffer overflow in sslvpn pre-authentication](https://www.fortiguard.com/psirt/FG-IR-23-097)
- [Analysis of CVE-2023-27997 and Clarifications on Volt Typhoon Campaign (Fortigate)](https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign)
- [Fortinet fixes critical RCE flaw in Fortigate SSL-VPN devices, patch now (BleepingComputer)](https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-rce-flaw-in-fortigate-ssl-vpn-devices-patch-now/)
- [Olympe Cyberdefense Alert](https://olympecyberdefense.fr/1193-2/)

If you have questions regarding this vulnerability or would like assistance, PacketWatch can help. [Contact us](https://packetwatch.com/contact) today.

Disclaimer  
The information provided in this article is provided “as-is.” It is not finally evaluated intelligence and should be considered raw information that is provided for strictly situational awareness, given what is known at this time.

[View full post](https://packetwatch.com/resources/threat-intel/pre-authentication-critical-vulnerability-in-fortinet-ssl-vpn)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "PacketWatch Team Sixty43"
  },
  "dateModified" : "2023-06-12T22:20:09.600Z",
  "datePublished" : "2023-06-12T20:24:18Z",
  "headline" : "Pre-Authentication Critical Vulnerability in Fortinet SSL VPN",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://23540019.fs1.hubspotusercontent-na1.net/hubfs/23540019/Blog%20Featured%20Images/Option%201%20%281%29.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://packetwatch.com/resources/threat-intel/pre-authentication-critical-vulnerability-in-fortinet-ssl-vpn",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "PacketWatch Threat Intelligence"
  }
}
```