Fortinet has released new Fortigate firmware updates that resolve a critical undisclosed pre-authentication remote code execution vulnerability in SSL VPN devices.

Security patches were released on Friday to FortiOS firmware versions 6.0.17, 6.2.15, 6.4.13, 7.0.12, and 7.2.5.

Although not mentioned in the release notes, security professionals and administrators hinted that the updates quietly fixed a critical SSL-VPN RCE vulnerability that would be disclosed on Tuesday, June 13, 2023.

“The flaw would allow a hostile agent to interfere through the VPN, even if MFA is enabled,” it reads. an opinion from the French cybersecurity company Olympe Cyberdefense.

“To date, all versions would be affected, we are waiting for the release of the CVE on June 13, 2023 to confirm this information.”

Fortinet is known for push security patches before disclosing critical vulnerabilities to give customers time to update their devices before hackers reverse-engineer fixes.

Today, additional information was released by Security Lexfo vulnerability researcher Charles Crazywho told BleepingComputer that the new FortiOS updates include a fix for a critical RCE vulnerability discovered by him and Rioru.

“Fortinet has released a patch for CVE-2023-27997, remote code execution vulnerability @DDXhunter and I have reported it,” read a tweet from Fol.

“This is pre-authentication accessible on every SSL VPN appliance. Fix your Fortigate. Details later. #xortigate.”

Fol confirmed to BleepingComputer that this should be considered an urgent fix for Fortinet admins as it is likely to be quickly scanned and discovered by threat actors.

Fortinet devices are among the most popular firewalls and VPNs on the market, making them a popular target for attacks.

By a Shodan ResearchOver 250,000 Fortigate firewalls are accessible from the Internet, and since this bug affects all previous versions, the majority are likely exposed.

In the past, SSL-VPN flaws have been exploited by hackers just a few days after the patches were releasedcommonly used to gain initial access to networks to carry out data theft and ransomware attacks.

Therefore, administrators should apply Fortinet security updates as soon as they become available.

BleepingComputer contacted Fortinet to inquire about the updates, but no response was immediately available.