# FortiBleed exposes 74,000 Fortinet device credentials

Published: 2026-06-18 · Severity: high · Sectors: government-national, financial-services, healthcare, energy, telecommunications, infrastructure
Canonical: https://vorant.io/reports/265b9cb4-bc77-5ac4-8b4b-4de87c13b37e/fortibleed-exposes-74-000-fortinet-device-credentials

> Threat actors are exploiting leaked credentials from ~74,000 internet-facing Fortinet firewalls and VPN gateways in a campaign dubbed FortiBleed.

CISA has issued an alert following reports that malicious cyber actors are actively targeting internet-accessible Fortinet devices across government and private sector organizations using compromised credentials. The campaign, designated FortiBleed, involves the exposure of credentials associated with approximately 74,000 Fortinet devices, including FortiGate firewalls and SSL VPN gateways. Multiple security vendors have confirmed the scope of the breach, with some reports indicating up to 80,000 affected devices spanning 194 countries.

CISA is directing affected organizations to take immediate defensive actions, including terminating all active SSL VPN and administrative sessions, resetting all passwords on internet-facing systems, and reviewing logs for indicators of lateral movement or unauthorized access. Organizations are urged to verify their use of the PBKDF2 algorithm for credential storage and remove weaker legacy hashes that may have facilitated the credential exposure.

The agency emphasizes implementing phishing-resistant multifactor authentication on all remote access and administrative accounts, restricting management interfaces to trusted internal networks, and ensuring Fortinet administration surfaces are not accessible from the public internet. This incident underscores the ongoing risk to perimeter security devices and the critical importance of hardening internet-facing infrastructure.

## Mentioned in this report

- Campaigns: Fortibleed

## Detection guidance (public sample)

### FortiGate SSL VPN Authentication from External Untrusted Source

ATT&CK: T1133

Detects successful SSL VPN logins on FortiGate devices originating from source IPs outside defined trusted/internal ranges, consistent with use of exposed credentials in the FortiBleed campaign. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiGate SSL VPN Authentication from External Untrusted Source
id: b3c40c47-1a1e-5d9e-a6c5-8d31f366c4bb
status: experimental
description: Detects successful SSL VPN authentication events on FortiGate/Fortinet
  appliances where the source IP is not part of known internal/trusted ranges, indicating
  possible use of credentials exposed via the FortiBleed campaign.
references:
- https://www.cisa.gov
logsource:
  category: firewall
  product: fortios
detection:
  selection:
    type: vpn
    subtype: ssl
    action: login
  filter_internal:
    remip|startswith:
    - '10.'
    - 172.16.
    - 192.168.
  condition: selection and not filter_internal
falsepositives:
- Legitimate remote employees connecting from home or travel who are not yet in an
  allow-listed range
- Misconfigured internal IP range definitions causing false external classification
level: medium
tags:
- attack.T1133
- attack.initial_access
author: Vorant
```

### Fortinet Administrative Interface Login from WAN Interface

ATT&CK: T1078

Detects administrative logins (GUI/SSH/HTTPS) to a FortiGate management interface sourced from the WAN/public interface rather than a trusted internal management network, indicating exposed management access potentially abused with stolen credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Fortinet Administrative Interface Login from WAN Interface
id: 04553cd9-e6d3-5f0c-963e-a72c6f3f42fd
status: experimental
description: Detects successful administrative authentication events to a Fortinet
  device where the login interface is the WAN/public-facing interface, indicating
  the management interface is internet-accessible and was used for authentication,
  consistent with FortiBleed exploitation of exposed credentials.
references:
- https://www.cisa.gov
logsource:
  category: firewall
  product: fortios
detection:
  selection:
    type: event
    subtype: system
    action: login
    logdesc: Admin login successful
  wan_intf:
    intf|contains:
    - wan
    - wan1
    - wan2
  condition: selection and wan_intf
falsepositives:
- Organizations that intentionally expose management interfaces to the internet for
  remote administration (not recommended)
- Devices where WAN interface is aliased for internal use
level: high
tags:
- attack.T1078
- attack.T1021
- attack.defense_evasion
author: Vorant
```

### Fortinet Login Using Default Administrator Account Name

ATT&CK: T1078.001

Detects successful authentication events on Fortinet devices using the default 'admin' account name, which is a common target for credential-stuffing using exposed FortiBleed credential dumps. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Fortinet Login Using Default Administrator Account Name
id: b9b73376-6576-50b3-b46f-f75b51682644
status: experimental
description: Detects successful login events on Fortinet appliances using the built-in
  default 'admin' account, which is frequently targeted in credential-based attacks
  such as the FortiBleed campaign where default account credentials were exposed.
references:
- https://www.cisa.gov
logsource:
  category: firewall
  product: fortios
detection:
  selection:
    action: login
    status: success
    user: admin
  condition: selection
falsepositives:
- Legitimate administrators who have not renamed the default admin account and log
  in for routine maintenance
level: low
tags:
- attack.T1078.001
- attack.initial_access
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/06/18/cisa-urges-hardening-fortinet-devices-after-reports-credential-exposure

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/265b9cb4-bc77-5ac4-8b4b-4de87c13b37e/fortibleed-exposes-74-000-fortinet-device-credentials.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup