Industry-leading cybersecurity and network security solution provider Fortinet has patched an actively exploited critical vulnerability in their Fortigate SSL-VPN solutions that is being exploited by threat actors to conduct remote code execution (RCE). The flaw, tracked as CVE-2023-27997 (CVSS of 9.2/10), has been dubbed “XORtigate” by researchers and is a pre-authentication heap-based buffer overflow vulnerability in every FortiOS and FortiProxy SSL-VPN appliance. Threat actors can exploit this flaw by sending maliciously crafted requests to vulnerable instances of FortiOS and FortiProxy, downloading a config file from the targeted devices, and adding a malicious “super_admin” user account named “fortigate-tech-support”. The threat actors facilitating the campaign are targeting victims in government as well as the manufacturing and critical infrastructure sectors. Historically, Fortinet products are popular targets for hackers, and Shodan scans indicate that there are currently more than 500,000 Fortigate firewalls that are reachable from the internet. Although just last month Microsoft attributed the exploitation of an unknown zero-day flaw in public-facing instances of Fortinet’s FortiGuard devices to a Chinese state-sponsored threat group named Volt Typhoon, Fortinet is hesitant to attribute the exploitation of XORtigate to the same threat actor at this time. Given the severity of the vulnerability coupled with its active exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added XORtigate to its Known Exploited Vulnerabilities (KEV) catalog, mandating that all Federal Civilian Executive Branch (FCEB) agencies patch the flaw by no later than July 4, 2023. The patch is available, and CTIX analysts recommend that any administrators managing Fortigate appliances install the updated software to prevent exploitation. If the patch cannot be immediately installed due to the negative effects that would have on critical processes, Fortinet has published some workaround mitigation techniques in their customer advisory. This matter is evolving in real-time, and CTIX may publish a future update in the event that further technical data or confirmed attribution to a known threat group is made.