NCSC warns of Fortinet firewall credential leak
A leaked credential database from brute-force and credential stuffing attacks against FortiGate/VPN portals prompts NCSC advisory for UK organisations.
Sourcencsc.gov.uk — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The UK's NCSC has issued an alert following a global campaign targeting Fortinet firewalls and SSL VPN gateways, with indications of impact in the UK. A threat actor leaked a database of credentials obtained through brute-force, dictionary, and credential stuffing attacks against internet-facing FortiGate and VPN portals. Credential stuffing exploits password reuse across services, meaning organisations whose users reused passwords elsewhere may be at risk regardless of any software vulnerability being exploited directly.
NCSC urges organisations using Fortinet edge devices with SSL VPN enabled to investigate for potentially malicious activity, check exposed domains using FortiBleed asset checkers, and monitor networks for unusual activity. Fortinet has published its own guidance and analysis referenced in the advisory. Priority actions include credential rotation, enabling MFA, and reviewing logs for signs of unauthorised access. The NCSC also promotes its free Early Warning service to help UK organisations detect malicious activity affecting their networks sooner.
No specific CVE, malware family, or threat actor attribution is provided in this advisory; the core risk vector described is credential-based attacks (brute-force, dictionary, credential stuffing) rather than a novel software exploit. Defenders should treat this as a call to verify exposure, rotate credentials, and enforce MFA on Fortinet VPN/firewall infrastructure.
Source reporting: https://www.ncsc.gov.uk/news/advice-following-global-targeting-of-fortinet-firewalls-and-vpn-gateways
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs