CVE-2023-27997

A heap-based buffer overflow in Fortinet FortiOS and FortiProxy SSL-VPN allows unauthenticated remote attackers to execute arbitrary code.

This critical vulnerability enables remote code execution without authentication, allowing attackers to compromise networks running Fortinet firewalls and SSL-VPN gateways. DIB organizations must urgently patch this flaw to prevent ransomware entry and maintain CMMC/NIST 800-171 compliance, as the vulnerability is actively exploited in the wild.

Shame score — A critical, unauthenticated RCE in a core firewall product that is actively exploited in the wild represents a severe, avoidable failure in securing critical infrastructure.