FortiBleed exposes 74,000 Fortinet device credentials
Threat actors are exploiting leaked credentials from ~74,000 internet-facing Fortinet firewalls and VPN gateways in a campaign dubbed FortiBleed.
CISA has issued an alert following reports that malicious cyber actors are actively targeting internet-accessible Fortinet devices across government and private sector organizations using compromised credentials. The campaign, designated FortiBleed, involves the exposure of credentials associated with approximately 74,000 Fortinet devices, including FortiGate firewalls and SSL VPN gateways. Multiple security vendors have confirmed the scope of the breach, with some reports indicating up to 80,000 affected devices spanning 194 countries.
CISA is directing affected organizations to take immediate defensive actions, including terminating all active SSL VPN and administrative sessions, resetting all passwords on internet-facing systems, and reviewing logs for indicators of lateral movement or unauthorized access. Organizations are urged to verify their use of the PBKDF2 algorithm for credential storage and remove weaker legacy hashes that may have facilitated the credential exposure.
The agency emphasizes implementing phishing-resistant multifactor authentication on all remote access and administrative accounts, restricting management interfaces to trusted internal networks, and ensuring Fortinet administration surfaces are not accessible from the public internet. This incident underscores the ongoing risk to perimeter security devices and the critical importance of hardening internet-facing infrastructure.
Mentioned in this report
Detection guidance
FortiGate SSL VPN Authentication from External Untrusted Source
Detects successful SSL VPN logins on FortiGate devices originating from source IPs outside defined trusted/internal ranges, consistent with use of exposed credentials in the FortiBleed campaign. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiGate SSL VPN Authentication from External Untrusted Source
id: b3c40c47-1a1e-5d9e-a6c5-8d31f366c4bb
status: experimental
description: Detects successful SSL VPN authentication events on FortiGate/Fortinet
appliances where the source IP is not part of known internal/trusted ranges, indicating
possible use of credentials exposed via the FortiBleed campaign.
references:
- https://www.cisa.gov
logsource:
category: firewall
product: fortios
detection:
selection:
type: vpn
subtype: ssl
action: login
filter_internal:
remip|startswith:
- '10.'
- 172.16.
- 192.168.
condition: selection and not filter_internal
falsepositives:
- Legitimate remote employees connecting from home or travel who are not yet in an
allow-listed range
- Misconfigured internal IP range definitions causing false external classification
level: medium
tags:
- attack.T1133
- attack.initial_access
author: Vorant
Fortinet Administrative Interface Login from WAN Interface
Detects administrative logins (GUI/SSH/HTTPS) to a FortiGate management interface sourced from the WAN/public interface rather than a trusted internal management network, indicating exposed management access potentially abused with stolen credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fortinet Administrative Interface Login from WAN Interface
id: 04553cd9-e6d3-5f0c-963e-a72c6f3f42fd
status: experimental
description: Detects successful administrative authentication events to a Fortinet
device where the login interface is the WAN/public-facing interface, indicating
the management interface is internet-accessible and was used for authentication,
consistent with FortiBleed exploitation of exposed credentials.
references:
- https://www.cisa.gov
logsource:
category: firewall
product: fortios
detection:
selection:
type: event
subtype: system
action: login
logdesc: Admin login successful
wan_intf:
intf|contains:
- wan
- wan1
- wan2
condition: selection and wan_intf
falsepositives:
- Organizations that intentionally expose management interfaces to the internet for
remote administration (not recommended)
- Devices where WAN interface is aliased for internal use
level: high
tags:
- attack.T1078
- attack.T1021
- attack.defense_evasion
author: Vorant
Fortinet Login Using Default Administrator Account Name
Detects successful authentication events on Fortinet devices using the default 'admin' account name, which is a common target for credential-stuffing using exposed FortiBleed credential dumps. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Fortinet Login Using Default Administrator Account Name
id: b9b73376-6576-50b3-b46f-f75b51682644
status: experimental
description: Detects successful login events on Fortinet appliances using the built-in
default 'admin' account, which is frequently targeted in credential-based attacks
such as the FortiBleed campaign where default account credentials were exposed.
references:
- https://www.cisa.gov
logsource:
category: firewall
product: fortios
detection:
selection:
action: login
status: success
user: admin
condition: selection
falsepositives:
- Legitimate administrators who have not renamed the default admin account and log
in for routine maintenance
level: low
tags:
- attack.T1078.001
- attack.initial_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free