UPDATE: A critical FortiGate firewall remote code execution (RCE) vulnerability that was patched in June 2023 is again vulnerable to exploitation after researchers developed a new proof-of-concept (PoC) exploiting the same vulnerability. The flaw, tracked as CVE-2023-27997 (CVSS 9.8/10), has been coined XORtigate, and is a pre-authentication heap-based buffer overflow vulnerability in FortiOS and FortiProxy SSL-VPN appliances. According to Shodan scans, researchers state that there are more than 335,000 unpatched instances exposed on the public internet, nearly 70% of all the known devices. The researchers from Bishop Fox state that the PoC exploit “smashes the heap, connects back to an attacker-controlled server, downloads a BusyBox binary, and opens an interactive shell,” in approximately one (1) second. Although exploitation is avoidable through patching, this matter indicates a much more significant problem in infrastructure defense as a whole. According to the researchers, many of the scanned vulnerable devices are running software versions that are as many as eight (8) years old. Hesitancy to patch infrastructure is the leading cause of exploitation, and CTIX analysts recommend all users and administrators follow the guidance in the Fortinet advisory linked below to prevent exploitation.