Most firewall breaches don’t start with a clever exploit. They start with a password that worked.
That is the uncomfortable lesson of FortiBleed, the credential-harvesting campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. On 6 October 2026 the FBI and the U.S. Secret Service published a joint advisory (JCSA-20261006-01) warning that the operation is still active — and that some victims are now being locked out of their own firewalls.
If you run FortiGate anywhere in your environment, this guide walks through what FortiBleed is, why patching alone won’t save you, and exactly what to check today.
What is FortiBleed?
FortiBleed is not a single vulnerability. There is no CVE to patch and, according to reporting on the advisory, no confirmed zero-day involved. It is a large-scale initial-access operation: attackers collect valid FortiGate credentials, verify which devices they can log into, and then use or sell that access.
SOCRadar’s threat research team first documented the campaign in June 2026 and reports more than 86,644 confirmed-compromised devices across 194 countries. That figure counts compromises SOCRadar confirmed, not just exposed devices — and devices breached months ago remain in the attackers’ inventory of working access.
Investigators were able to reconstruct much of the operation because the operators exposed their own backend server through an open directory.
How the attackers get in
Based on SOCRadar’s analysis and the advisory coverage, the campaign follows a familiar initial-access-broker pattern:
- Find exposed portals. Internet-wide scanning for FortiGate SSL VPN and management interfaces.
- Try known credentials. Credential stuffing and password spraying, seeded with passwords from earlier breaches and infostealer logs.
- Crack what they collect. Password hashes taken from compromised devices are cracked offline. SOCRadar points to legacy SHA-256 password storage in older FortiOS configurations as a key weakness.
- Persist. New administrator accounts are planted so access survives a password change.
- Monetise. Working VPN access and target lists are used directly or sold to ransomware affiliates. Reporting names INC/Lynx among the downstream buyers.
None of this requires sophisticated tooling. It works because so many edge devices still accept a single reused password from anywhere on the internet.
The lockout problem
What makes the October advisory different is the lockouts. In some intrusions the attackers don’t just add their own admin account — they delete or change the passwords of the legitimate accounts. The defenders lose control of their own firewall while the attacker keeps it.
That has an important consequence: a routine password reset may not return the device to a clean state. If an unknown admin account, API key or configuration change is still there, the attacker is still there.
Why “just patch it” doesn’t work here
With a typical vulnerability you apply the fix and move on. FortiBleed abuses valid credentials, so a fully patched FortiGate with a reused admin password is just as exposed as an unpatched one. Updating FortiOS is still worth doing — newer versions support stronger password hashing — but the real fixes are credential hygiene, MFA and getting management interfaces off the internet.
How to check if your FortiGate is compromised
Work through these checks on every internet-facing FortiGate, starting with the ones that have management or SSL VPN exposed publicly.
1. Audit administrator accounts
- List every local admin account and compare it to what you expect. Any account nobody recognises should be treated as a confirmed intrusion indicator, not a curiosity.
- Check for accounts whose passwords were changed recently without a matching change ticket.
- Compare against the account names listed in the advisory and SOCRadar’s indicators.
2. Review REST API keys and SSH access
- Enumerate all REST API admin keys and remove any you can’t attribute to a known integration.
- If SSH management was ever left reachable from the internet, review its access logs.
3. Check authentication logs
- Look for bursts of failed VPN or admin logins (spraying), followed by a success from the same source.
- Check successful logins from countries, hosting providers or times that don’t fit your users.
- Compare source IPs against the indicators published with the advisory. Cloud IPs get reassigned, so corroborate before blocking.
4. Compare configuration against a known-good baseline
Diff the running configuration against your last trusted backup. Pay particular attention to new admin users, changed trusted-host settings, new firewall policies, VPN user groups and any change to logging.
5. Look behind the firewall
FortiBleed access is a starting point, not the goal. Review domain controller and internal logs for Active Directory enumeration bursts, password spraying against privileged accounts and new account creation originating from VPN address pools. If you find this, follow your incident response process rather than just cleaning the firewall.
How to lock FortiGate down
These recommendations come from the joint advisory coverage and SOCRadar’s guidance. Do the first four today.
- Take management off the internet. Restrict administrative access to trusted hosts, enforce a local-in policy, or remove internet-facing administration entirely.
- Kill sessions and reset credentials. Terminate active admin sessions, then reset all VPN and administrator passwords on internet-facing devices — after you’ve removed any unknown accounts and keys.
- Enforce phishing-resistant MFA on every remote-access and administrative account. Password-only VPN access is exactly what this campaign feeds on. (New to this? Start with our guide to two-factor authentication.)
- Fix password storage. Confirm admin credentials use PBKDF2 hashing and purge legacy hashes. SOCRadar’s guidance references FortiOS 7.2.11 and later for this.
- Keep out-of-band recovery. Make sure you can regain control of edge devices through console or out-of-band access if an attacker locks you out.
- Feed the logs somewhere useful. Forward firewall, VPN and authentication logs to your SIEM and alert on new admin accounts and impossible-travel logins. If you don’t have that capability yet, our guide to setting up a SOC covers the basics.
If you’re already locked out
- Treat the device as compromised and the network behind it as potentially compromised.
- Use console or out-of-band access to regain control, preserve logs and configuration for investigation, then rebuild from a known-good configuration rather than trying to clean in place.
- Scope the intrusion before you change too much — tipping off an attacker who already has internal access can make things worse.
- CISA’s Eviction Strategies Tool is a useful structure for the response.
- Report it to the FBI’s IC3, your local FBI field office or CISA. Do not pay a ransom.
The bigger lesson
FortiBleed is the edge-device version of a story we keep telling: ransomware crews rarely need zero-days when valid credentials are for sale. VPN gateways and firewalls are now the front door to most corporate networks, and they deserve the same identity controls as anything else — which is the core idea behind Zero Trust architecture.
If you only take one action from this article: find out today whether anyone can log into your firewall’s management interface from the internet with just a password. If the answer is yes, that’s your weekend sorted.
