FortiBleed: What Fortinet Customers Need to Know About the Latest Credential Exposure Campaign

CISA Issues Warning as FortiBleed Impacts Tens of Thousands of Fortinet Devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently issued an alert urging organizations using Fortinet firewalls and VPN gateways to take immediate action following reports of a widespread credential exposure campaign known as “FortiBleed.” Security researchers estimate that between 74,000 and 86,000 Fortinet devices may be affected, making this one of the most significant attacks targeting network security infrastructure in recent years.

The campaign is believed to be linked to Russian-speaking threat actors who have leveraged exposed credentials, password reuse, and automated attacks to gain unauthorized access to Fortinet devices around the world. Unlike a traditional zero-day vulnerability, FortiBleed highlights a growing cybersecurity challenge: attackers increasingly rely on compromised credentials rather than software flaws to infiltrate organizations.

How the FortiBleed Campaign Works

Researchers report that attackers are using automated tools to scan the internet for exposed Fortinet firewalls and SSL VPN gateways. Once identified, they attempt to authenticate using credentials obtained through previous breaches, password reuse, credential harvesting, and brute-force attacks.

What makes FortiBleed particularly dangerous is its ability to scale. Once attackers successfully compromise a device, they can monitor network traffic, collect additional credentials, and use those credentials to compromise other systems within the environment. This creates a self-perpetuating cycle that allows threat actors to expand their access across networks and organizations.

For many small and midsize businesses, the risk is even greater. Fortinet solutions are widely adopted due to their affordability and ease of deployment. However, organizations that lack dedicated security personnel or managed security oversight may not realize they have been compromised until significant damage has already occurred.

Why Previously Patched Systems May Still Be at Risk

One of the more concerning aspects of FortiBleed is that some organizations may remain vulnerable even after performing software upgrades.

Legacy password storage mechanisms used in older FortiOS versions may still exist in upgraded environments. In some cases, administrator credentials continued to be stored using weaker hashing methods, potentially allowing attackers to recover passwords and gain access to systems despite software updates.

This serves as an important reminder that patching alone is not enough. Organizations must also review how credentials are stored, managed, and protected throughout their environments.

Industries Across the Globe Are Being Targeted

Researchers have identified victims across numerous industries, including technology, telecommunications, construction, manufacturing, and government organizations. The campaign has impacted organizations worldwide, with the United States among the most heavily affected countries.

Security experts have also warned that attackers are building extensive databases of compromised credentials that can be reused in future attacks. Once valid administrative credentials are obtained, threat actors can modify firewall configurations, create backdoor accounts, disable security controls, and establish long-term persistence within a network.

What Organizations Should Do Immediately

CISA and security researchers recommend that organizations using Fortinet devices take the following actions as soon as possible:

1. Terminate Active SSL VPN Sessions

Immediately terminate all active SSL VPN and administrative sessions to reduce the risk of unauthorized access.

2. Reset Administrative Credentials

Change all VPN, firewall, and administrator passwords, particularly for internet-facing systems. Organizations should also review password policies and eliminate password reuse.

3. Verify Secure Password Storage

Ensure administrator credentials are stored using Fortinet’s recommended password protection mechanisms, including PBKDF2, and remove any weaker legacy password hashes.

4. Review Security Logs

Examine firewall, VPN, authentication, and domain controller logs for signs of suspicious activity, lateral movement, unauthorized configuration changes, or unusual login behavior.

5. Enable Multi-Factor Authentication (MFA)

Implement phishing-resistant MFA across all remote access points, VPNs, administrative accounts, and external-facing interfaces.

6. Reduce Your Attack Surface

Restrict management access to trusted internal networks, disable unnecessary accounts, and avoid exposing firewall administration interfaces directly to the internet whenever possible.

The Bigger Picture: Firewall Security Requires Ongoing Management

FortiBleed is only the latest example of how critical network infrastructure continues to be a prime target for cybercriminals. While Fortinet has faced increased attention due to its popularity among small and midsize businesses, no firewall vendor is immune. Organizations using Fortinet, Cisco, Palo Alto Networks, and other security platforms all face a constant stream of emerging threats and vulnerabilities.

The reality is that modern firewalls require ongoing monitoring, patch management, credential hygiene, configuration reviews, and threat detection. An unmanaged firewall can quickly become an organization’s greatest security risk rather than its strongest defense.

How Dataprise Can Help

At Dataprise, our cybersecurity and incident response teams help organizations identify, contain, and remediate threats before they become business-disrupting incidents.

Whether you need assistance assessing your Fortinet environment, validating your exposure to FortiBleed, reviewing firewall configurations, implementing MFA, or conducting a full incident response investigation, our experts are ready to help.

If your IT provider has not contacted you about FortiBleed, now is the time to ask why.

Cyber threats continue to evolve, and proactive security management has never been more important. Dataprise can help you assess your environment, strengthen your defenses, and reduce the likelihood that credential-based attacks like FortiBleed put your business and customer data at risk.

Concerned about your Fortinet environment? Contact Dataprise today for a security assessment or incident response consultation.

Resources:

CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

Companies using Fortinet Fortigate and its marketshare

James Morrison is the Security Sales Strategist at Dataprise, bringing more than 30 years of cybersecurity, technology, and leadership experience. Prior to joining Dataprise, he held senior security leadership roles, including Chief Information Security Officer, and spent 22 years with the FBI leading cybersecurity and criminal intrusion investigations. James has also served in key technology positions with HPE, Lockheed Martin, and the U.S. Air Force, making him a trusted advisor on cybersecurity strategy, risk management, and incident response.

Connect with James on LinkedIn