CVSS—
Severityhigh
Weakness—
EPSS85.7%99.7th percentile
Exploited3 KEV sources
Ransomware useKnown
Federal fix dueJul 4, 2023
patch window
Called exploited 1 days before disclosure.
Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.
The life of this vulnerability
- CVE published
- First KEV listing1d
- Last KEV listing1d
- Last sighting3.1y
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federallisted Jun 13, 2023
- EUVDENISA, European Unionlisted Jun 13, 2023
- VulnCheck KEVcommercial researchlisted Jun 12, 2023
- CIRCLaggregator, mirrors the abovelisted Jun 13, 2023, not counted
Sources3 of 3
Listings differ by1 d
Strongest claimconfirmed
3 catalogues list it. CIRCL aggregates the others and is shown but not counted.
Public exploitation evidence
- reported exploitationinsights.nccgroup.com/l/898251/2026-07-20/31nm9cf/898251/178
- reported exploitationblog.qualys.com/vulnerabilities-threat-research/2026/07/08/f
- reported exploitationwww.cloudsek.com/blog/operation-escaneo-mexican-government-f
- reported exploitationfortgale.com/blog/defence/operation-storming-tide/
- reported exploitationwww.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf
- reported exploitation5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-20
44 public reports collected from VulnCheck and CIRCL, first on Jun 12, 2023. Each links to its original source. We have not verified them.
Description
Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via specifically crafted requests.
Required action (CISA)
Apply updates per vendor instructions.
