A single misconfigured server sitting on the open internet has turned into one of the largest perimeter-security incidents of the decade. Dubbed FortiBleed, the campaign has left working administrator and VPN credentials for 86,644 Fortinet firewalls in the hands of a Russian-speaking criminal crew – roughly half of every internet-facing Fortinet device on the planet, spread across 194 countries. Security researchers first flagged the exposed cache in mid-June 2026, and within six days the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the UK National Cyber Security Centre and Fortinet’s own product security team had all published emergency guidance.
What makes the FortiBleed disclosure so alarming is not a flashy zero-day. Fortinet insists no new vulnerability is involved. Instead, attackers weaponized weak password hygiene, legacy hash storage and the industry’s blind trust in the very appliances meant to keep intruders out. This news analysis unpacks the scale of the Fortinet credential compromise, how the attack chain actually works, what it means for the enterprise security market, and where perimeter defense goes from here.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
July 2026 Update: FortiBleed Numbers Hold Steady
Update – July 14, 2026: A month after disclosure, the FortiBleed figures remain exactly where SecurityWeek’s June 19, 2026 report left them. The confirmed tally is still 86,644 compromised Fortinet FortiGate credentials across 194 countries – roughly 50% of all internet-facing Fortinet firewalls – with no higher revision published since. CISA’s June 18, 2026 emergency advisory ordering session termination, credential rotation and MFA enforcement remains in force, and to date no CVE has been assigned to the campaign. Broader attack volume also holds at 1.16 billion credential attempts against more than 320,000 FortiGate targets and 2.1 billion brute-force attempts against Microsoft SQL Server hosts. The takeaway a month on is unchanged: this is a credential-hygiene failure with nothing to patch, so any organization that has not yet rotated FortiGate credentials and retired legacy SHA-256 hash storage remains exposed today.
What Is FortiBleed? Inside the 86,644-Credential Fortinet Breach
FortiBleed is the name researchers gave to a sprawling credential-harvesting operation that has quietly scraped, cracked and catalogued login data from FortiGate firewalls and SSL VPN gateways since at least February 2026. The campaign burst into public view when independent researchers discovered an internet-exposed server holding downloaded FortiGate configuration files, harvested credentials from more than 73,000 devices, and the tooling used to crack password hashes and run credential-stuffing attacks at scale.
By the time SecurityWeek reported the incident on June 19, 2026, the confirmed tally had climbed to 86,644 unique working credentials. Unlike a data dump of stale passwords, these were validated, currently usable logins for perimeter appliances – the digital equivalent of a burglar holding tested keys to tens of thousands of front doors. The name deliberately echoes 2023’s “Citrix Bleed,” another perimeter-appliance catastrophe, and signals that the industry’s edge devices remain a favorite hunting ground.
Crucially, FortiBleed is not the result of a single exploited flaw. It is an aggregation attack: years of leaked credentials, brute-forced logins, exfiltrated configuration files and cracked hashes, all stitched together into one searchable database and sorted by country, industry sector and even organization revenue. That industrialized packaging is what elevates FortiBleed from routine background noise to a systemic threat.
How the FortiBleed Attack Chain Works
The FortiBleed attack chain is a masterclass in patient, low-noise operations. Rather than smashing through a firewall with an exploit, the operators harvested the raw material to simply log in. Two techniques did most of the damage: configuration-file exfiltration paired with offline hash cracking, and a custom traffic-sniffing implant planted on already-compromised devices.
Config Exfiltration and SHA-256 Hash Cracking
When an attacker obtains a FortiGate configuration file – through an old vulnerability, a phishing-harvested login or a reused password – it contains stored administrator password hashes. For years, FortiOS stored those hashes using SHA-256, an algorithm that modern GPUs can grind through at enormous speed. Fortinet has since moved to PBKDF2-based hashing in FortiOS 7.2.11, 7.4.8 and 7.6.1, which is dramatically more resistant to offline cracking. The catch: when a device is upgraded, existing administrator passwords remain stored as legacy SHA-256 hashes until each admin logs in again. Countless upgraded-but-not-fully-rotated devices therefore kept crackable hashes long after the “fix” shipped.
The FortiBleed operators cracked those hashes at industrial scale. Security researcher Volodymyr “Bob” Diachenko, who examined the exposed infrastructure, described the workflow bluntly: “They intercept SSL VPN authentication, crack hashes on a 45-GPU cluster managed via Hashtopolis, and pivot into internal Active Directory environments,” he told SecurityWeek. A 45-GPU cracking rig turns a “strong” eight-character password into a matter of hours.
The ‘FortiGate Sniffer’ VPN Interceptor
On devices they already controlled, the attackers deployed a bespoke packet-sniffing tool nicknamed “FortiGate Sniffer.” Running directly on the firewall, it intercepted SSL VPN authentication and other credentials straight from network traffic – capturing plaintext logins as legitimate users signed in. Because the tool lived on a trusted appliance, it generated almost no conventional alerts. Each freshly captured credential fed back into the database, letting the campaign expand from device to device without ever tripping an endpoint detection tool on a laptop or server.
The Numbers: 194 Countries, 320,000 Targets, 1.16 Billion Login Attempts
The raw statistics behind FortiBleed explain why it triggered a coordinated government response. Researchers observed brute-force and credential-validation activity at a scale that dwarfs typical opportunistic scanning. Fortinet firewalls were hit with roughly 1.16 billion credential attempts against more than 320,000 FortiGate targets, while the same infrastructure launched 2.1 billion brute-force attempts against 160,000+ Microsoft SQL Server hosts – a reminder that this crew was not exclusively focused on Fortinet.
| FortiBleed metric | Figure | Source |
|---|---|---|
| Confirmed working credentials | 86,644 | SecurityWeek / SOCRadar |
| Share of internet-facing Fortinet firewalls | ~50% | Kevin Beaumont (Shodan polling) |
| Countries affected | 194 | Arctic Wolf Labs |
| Credential attempts vs FortiGate targets | 1.16 billion / 320,000+ | SecurityWeek |
| Brute-force attempts vs MSSQL servers | 2.1 billion / 160,000+ | SecurityWeek |
| Partner organizations impacted | 845 | Huntress |
| Devices whose configs were on the exposed server | 73,000+ | Researcher analysis |
| Campaign active since | February 2026 | Multiple researchers |
The scope figure that stopped executives cold came from British researcher Kevin Beaumont, who cross-referenced the leaked set against internet-scanning data. “The data comprises roughly 15% of all Fortinet firewall devices facing the internet, based on polling from Shodan,” Beaumont noted. Endpoint-protection firm Huntress separately confirmed that 845 of its partner organizations appeared in the exposed credential set, underscoring that the victims are not fringe targets but mainstream businesses.
Fortinet’s Response: ‘This Is Not a New Vulnerability’
Fortinet moved fast to frame the narrative. In a PSIRT blog post published June 19, 2026, the company was unambiguous: “This is not a new Fortinet vulnerability, and this activity is not related to any recent incident or advisory.” The vendor attributes FortiBleed to threat actors reusing credentials from previous incidents – referencing prior advisories FG-IR-26-060 and FG-IR-25-647 – combined with brute-force attacks against devices that lacked strong passwords and multi-factor authentication.
Fortinet also confirmed it “has been working with government authorities to investigate the credential leak and has begun notifying affected customers.” Its mitigation guidance is a checklist of security hygiene that many organizations should have completed years ago: terminate all administrator and VPN sessions, reset every credential, enforce phishing-resistant MFA, upgrade to FortiOS 7.4, 7.6 or 8.0 for PBKDF2 hashing, validate configurations for unauthorized changes and restrict external management access.
The “not our fault” positioning is technically defensible – no unpatched flaw powered FortiBleed – but it sits uneasily with the reality that legacy SHA-256 hashes survived upgrades by design, and that internet-exposed management interfaces have long been a Fortinet default that many admins never locked down. For customers staring at a breach, the distinction between “product vulnerability” and “product-enabled misconfiguration” offers cold comfort.
CISA and NCSC Sound the Alarm
Government agencies did not wait for attribution to act. On June 18, 2026, CISA issued an advisory urging security teams to “take immediate steps to harden their Fortinet environments,” while the UK’s NCSC published a parallel global warning. The speed of the response – three major advisories inside a single week – reflects how central Fortinet appliances are to critical infrastructure, government networks and the enterprise mid-market alike.
The core anxiety is trust. Perimeter appliances are, by definition, positioned at the boundary of every sensitive network, and they are usually granted sweeping access. Ensar Seker, Chief Information Security Officer at threat-intelligence firm SOCRadar, summed up the systemic risk in comments to Cybersecurity Dive:
“The threat is significant because many organizations treat perimeter security appliances as trusted infrastructure. If attackers obtain valid credentials for firewalls, VPN gateways or administrative interfaces, they can bypass many traditional security controls and gain direct access to internal environments.”
Ensar Seker, CISO, SOCRadar, via Cybersecurity Dive
CISA’s recommended hardening steps mirror Fortinet’s: kill active sessions, rotate credentials, adopt PBKDF2 password storage, enable phishing-resistant MFA and lock down management access to trusted networks only. For defenders, the message is that a valid login is now a more dangerous weapon than a novel exploit – because it looks, to most monitoring tools, exactly like legitimate business activity.
The Ransomware Connection: INC and Lynx
FortiBleed is not an academic exercise in credential collection – it is a ransomware supply line. Investigators tracing the campaign’s infrastructure found an operator logged into both the INC Ransom and Lynx ransomware negotiation panels, and victims listed on INC Ransom’s leak site overlapped with organizations in the FortiBleed data. In other words, the same crew harvesting Fortinet credentials was also running double-extortion attacks with the access those credentials provided.
The conversion rate from access to encryption is sobering. Researchers tracked scanning against roughly 11,250 FortiGate portals in more than 150 countries, which yielded confirmed admin-level access on 409 targets and a completed attack chain on 354 of them. From that foothold, at least 12 confirmed ransomware deployments followed, encrypting hundreds of endpoints across the affected organizations. A firewall login, in this model, is simply step one of a ransomware playbook that ends in an eight-figure extortion demand.
The geopolitical overlay adds urgency. The Russian-speaking operators reportedly prioritized NATO-linked organizations, government entities and critical-infrastructure providers, and researchers documented the compromise of a Turkish defense contractor working with NATO. When state-adjacent targeting meets financially motivated ransomware, the line between espionage and extortion blurs – and defenders can no longer assume that a “criminal” breach will stop at data theft.
Why Perimeter Appliances Are the New Soft Target
FortiBleed lands in the middle of a multi-year trend: attackers have shifted from chasing endpoints to targeting the network edge. Firewalls, VPN concentrators and secure gateways sit outside the reach of most endpoint detection and response (EDR) tooling, run proprietary operating systems that resist inspection, and are frequently left unpatched because taking them offline disrupts the entire business. That combination makes them ideal beachheads.
The economics favor the attacker. A single compromised firewall can expose an entire corporate network, whereas a single compromised laptop usually exposes one user. When an operator can validate 86,644 firewall logins in one campaign, the return on investment is staggering. And because perimeter devices are trusted implicitly, a malicious login from a stolen credential rarely triggers the behavioral alerts that would fire if the same attacker landed on a domain controller.
This is the strategic lesson of FortiBleed, and it applies well beyond Fortinet. Every vendor of edge infrastructure – Cisco, Palo Alto Networks, Citrix, Ivanti, SonicWall – has shipped appliances that later became mass-exploitation targets. The uncomfortable truth is that the device you buy to enforce zero trust is often the least-monitored, most-trusted box on your network. FortiBleed simply proves the thesis at record scale.
FortiBleed in Context: Fortinet’s History of Exploited Flaws
To understand why 86,644 sets of crackable hashes were sitting in configuration files, you have to look at the steady drumbeat of critical Fortinet vulnerabilities over the past four years. Each mass-exploitation event handed attackers another wave of configuration files and credentials – the exact raw material FortiBleed later aggregated. The pattern is not one bad year; it is a recurring cycle.
| CVE | Fortinet component | Type | CVSS | Year exploited |
|---|---|---|---|---|
| CVE-2022-40684 | FortiOS / FortiProxy | Auth bypass | 9.8 | 2022 |
| CVE-2023-27997 (XORtigate) | FortiOS SSL VPN | Heap overflow / RCE | 9.8 | 2023 |
| CVE-2024-21762 | FortiOS SSL VPN | Out-of-bounds write / RCE | 9.8 | 2024 |
| CVE-2024-55591 | FortiOS / FortiProxy | Auth bypass (websocket) | 9.6 | 2024–2025 |
| FortiBleed (campaign) | FortiGate credentials | Credential aggregation | N/A | 2026 |
Each of those flaws was patched, sometimes within days. But patching a device does not automatically rotate the credentials or configuration data that leaked while it was vulnerable. That is the through-line of FortiBleed: an attacker who grabbed a config file during the 2024 SSL VPN exploitation window could still be cracking and using those hashes in 2026 if the admin never changed the password. Vulnerability management fixed the door; nobody changed the locks.
Market Impact: Enterprise Security and Fortinet’s Standing
Fortinet is one of the largest network-security vendors in the world, with millions of firewalls deployed and a customer base that spans small businesses to national governments. An incident that touches roughly half of its internet-facing installed base is therefore a market event, not just a security one. Procurement teams that standardized on FortiGate for cost and performance are now fielding board-level questions about concentration risk – the danger of betting an entire security architecture on one vendor’s edge appliance.
The competitive fallout could accelerate two trends already reshaping the market. First, the shift toward secure access service edge (SASE) and cloud-delivered security, which reduces reliance on physical VPN concentrators that expose crackable configuration files. Second, a renewed push for identity-centric zero trust, where a valid credential alone is never sufficient – continuous verification, device posture and phishing-resistant MFA gate every session. Vendors positioned around those models, from Zscaler to Cloudflare to Palo Alto’s Prisma line, stand to benefit from Fortinet’s discomfort.
For Fortinet itself, the reputational math is delicate. The company can credibly argue that customer misconfiguration, not a product defect, enabled FortiBleed. But “your users held it wrong” is a difficult message when the default settings and legacy hash behavior made the mistake easy to make. Expect Fortinet to respond with more secure defaults, automated credential-rotation prompts after upgrades, and aggressive MFA enforcement – changes that should have been standard long before a campaign hit 194 countries.
How to Detect and Mitigate FortiBleed
Because FortiBleed relies on valid credentials, the remediation priority is unambiguous: assume compromise, rotate everything, and enforce MFA before hunting for indicators. Any FortiGate that has ever been internet-exposed or was running a vulnerable FortiOS build during past exploitation windows should be treated as potentially in the leaked set. The following priority checklist condenses the guidance from Fortinet, CISA and independent responders.
| Action | Priority | Why it matters |
|---|---|---|
| Terminate all admin & SSL VPN sessions | Immediate | Evicts any attacker riding a stolen live session |
| Reset every admin, local and VPN credential | Immediate | Invalidates cracked/leaked passwords in the FortiBleed set |
| Enforce phishing-resistant MFA | Immediate | A stolen password alone can no longer authenticate |
| Upgrade to FortiOS 7.4 / 7.6 / 8.0 (PBKDF2) | High | Replaces crackable legacy SHA-256 hash storage |
| Remove management interface from the internet | High | Shrinks the attack surface the campaign scans |
| Audit configs for unauthorized changes / new accounts | High | Detects persistence, rogue admins and altered policies |
| Review logs for impossible-travel & off-hours logins | Medium | Surfaces credential misuse that looks “legitimate” |
Rotating credentials is not a one-line command, but the core FortiOS steps are straightforward. The illustrative sequence below shows how an administrator can check the running build, review admin accounts, force a password reset and clear active sessions – the minimum first response to a suspected FortiBleed exposure.
# Confirm FortiOS version and build (check against PBKDF2-capable releases)
get system status
# Review every administrator account for rogue/new entries
show system admin
# Force-reset an administrator password
config system admin
edit "admin"
set password <new-strong-passphrase>
next
end
# Restrict admin logins to trusted source IPs (trusthost)
config system admin
edit "admin"
set trusthost1 10.0.0.0 255.255.255.0
next
end
# Terminate active SSL VPN tunnels to evict live sessions
execute vpn sslvpn del-all
# Inspect recent admin/VPN authentication events
execute log filter category event
execute log displayFor detection, defenders should hunt for admin or VPN logins from unfamiliar countries and hosting-provider IP ranges, unexpected new accounts or privilege changes, configuration drift such as new port forwards or disabled logging, and any sign of the “FortiGate Sniffer” implant. Feeding FortiGate logs into a SIEM makes these patterns far easier to catch than manual review.
Competitive Fallout: Palo Alto, Cisco and the SSL VPN Reckoning
FortiBleed does not let competitors off the hook – it indicts an entire product category. In the past 24 months, Cisco, Palo Alto Networks, Citrix, Ivanti and SonicWall have all patched critical, actively exploited flaws in VPN and firewall products. The 2023 “Citrix Bleed” saga that FortiBleed’s name references saw NetScaler devices harvested at scale, and Ivanti’s Connect Secure gateways became a byword for edge-device compromise. The pattern is a category problem, not a single-vendor failure.
Still, market perception rewards whoever was not in the latest headline. Palo Alto Networks and Zscaler are likely to lean into FortiBleed in competitive sales cycles, emphasizing cloud-delivered security and identity-first architectures that never expose a crackable on-box configuration file. Expect “get off legacy SSL VPN” to become a dominant marketing theme through the rest of 2026, echoing the guidance many agencies have quietly pushed for years.
The deeper reckoning is architectural. SSL VPN was designed for a world where the network perimeter meant something. In a cloud-first, work-from-anywhere environment, funneling every remote user through an internet-facing appliance that stores administrative secrets is increasingly indefensible. FortiBleed may be remembered less as a Fortinet story and more as the moment the industry finally accepted that the legacy VPN concentrator is a liability whose time has passed.
What Happens Next: 5 Predictions for Perimeter Security
FortiBleed will reverberate well beyond the initial patch-and-rotate scramble. Based on the campaign’s trajectory, the ransomware overlap and the coordinated government response, here are five developments to watch through the remainder of 2026 and into 2027.
- A wave of downstream ransomware. With INC and Lynx already deploying encryptors from FortiBleed access, expect additional intrusions and extortion events over the coming months as buyers work through the 86,644-credential set before defenders finish rotating.
- Mandatory MFA and secure defaults from Fortinet. Look for FortiOS updates that force credential rotation after upgrades, prompt for PBKDF2 migration and enable MFA by default on management interfaces – closing the exact gaps FortiBleed exploited.
- Regulatory and insurance pressure. Cyber-insurers are likely to add explicit questions about internet-exposed management interfaces and legacy hash storage, and edge-device hygiene will feature in future CISA binding directives.
- Accelerated SSL VPN retirement. Enterprises will fast-track migrations to zero-trust network access and SASE, treating always-on VPN concentrators as legacy tech to be decommissioned rather than merely patched.
- More “-Bleed” campaigns by name. The success of branding a credential-aggregation campaign will inspire copycats against other edge vendors, as researchers and criminals alike learn that packaging old leaks into a searchable database is cheaper and quieter than burning a zero-day.
The Bottom Line on the Fortinet Credential Compromise
FortiBleed is a discipline story disguised as a breach story. No zero-day, no exotic malware, no nation-state exploit chain – just leaked credentials, legacy hashes and unpatched hygiene, industrialized into a database that put half the internet’s Fortinet firewalls at risk. The 86,644 compromised logins are a symptom; the disease is the enduring assumption that a perimeter appliance is trustworthy simply because it is the thing enforcing trust.
For every organization running a FortiGate, the action is the same regardless of whether they see their name in the leak: rotate every credential, enforce phishing-resistant MFA, retire legacy hash storage, and get the management interface off the public internet. For the industry, FortiBleed is the clearest signal yet that identity – not the firewall – is the real perimeter now.
Related Coverage
- ShinyHunters Hit 100+ Orgs via Oracle Zero-Day [2026]
- Foxconn Cyberattack: Nitrogen Steals 8TB, 11M Files [2026]
- The Gentlemen Ransomware: 483 Victims, 90% Cut [2026]
- Fail2ban: Stop SSH Brute-Force in 12 Steps, 30 Min [2026]
- Wazuh Tutorial: Free SIEM in 14 Steps, 40 Min [2026]
- Proton Pass vs Bitwarden vs 1Password: $0 vs $48 [2026]
- More cybersecurity threats and analysis for 2026
Frequently Asked Questions
What is FortiBleed?
FortiBleed is a large-scale credential-harvesting campaign, active since at least February 2026, that aggregated working administrator and VPN credentials for 86,644 internet-facing Fortinet firewalls across 194 countries. Researchers discovered the data on an exposed server in mid-June 2026, prompting advisories from CISA, the UK NCSC and Fortinet.
Is FortiBleed a new Fortinet vulnerability or zero-day?
No. Fortinet states that “this is not a new Fortinet vulnerability.” FortiBleed relies on reused credentials from earlier incidents, brute-force attacks against devices without MFA, and offline cracking of legacy SHA-256 password hashes extracted from configuration files – not an unpatched flaw.
How many Fortinet devices were affected by FortiBleed?
Researchers confirmed 86,644 working credentials, which Kevin Beaumont estimates represents roughly 15% of all internet-facing Fortinet firewalls based on Shodan data. The exposed server held configuration files from more than 73,000 devices, and endpoint firm Huntress identified 845 of its partner organizations in the set.
Is FortiBleed connected to ransomware?
Yes. Investigators linked FortiBleed to the INC Ransom and Lynx ransomware operations, finding an operator logged into both groups’ negotiation panels. At least 12 ransomware deployments have been tied to the access, with the campaign also prioritizing NATO-linked and critical-infrastructure targets.
How do I check if my Fortinet firewall is compromised?
Treat any device that was internet-exposed or ran a vulnerable FortiOS build as potentially affected. Review admin and VPN logins for unfamiliar geographies and off-hours access, audit for new or modified admin accounts and configuration drift, and check for the “FortiGate Sniffer” implant. When in doubt, assume compromise and rotate all credentials.
What should organizations do to mitigate FortiBleed?
Immediately terminate all admin and SSL VPN sessions, reset every credential, and enforce phishing-resistant MFA. Then upgrade to FortiOS 7.4, 7.6 or 8.0 for PBKDF2 hashing, remove the management interface from the public internet, validate configurations for unauthorized changes, and review logs for suspicious authentication activity.
Why is the FortiBleed campaign called ‘FortiBleed’?
The name deliberately echoes 2023’s “Citrix Bleed,” a similar mass-compromise of perimeter appliances. It signals both the Fortinet target and the broader industry problem: internet-facing edge devices that leak the credentials and secrets they are supposed to protect.
