Log in Request a demo

Significant cyber incident

Fortinet device credential exposure

In mid-June 2026, government agencies warned that leaked credentials for about 74,000 Fortinet firewalls and VPN gateways were being used against internet-facing devices.

In short

In mid-June 2026, government agencies warned that leaked credentials for about 74,000 Fortinet firewalls and VPN gateways were being used against internet-facing devices. The campaign is called FortiBleed. Fortinet says it is not a new flaw. It says attackers reused old credentials and guessed weak passwords on devices without multi-factor authentication. It matters because a firewall login gives an attacker a way into the internal network.

Last updated 9 October 2026

What happened

On 18 June 2026, CISA, the UK NCSC and the Canadian Cyber Centre each published alerts about a campaign called FortiBleed. CISA said malicious actors were using compromised credentials against internet-accessible Fortinet devices in government and private sector organizations.

CISA linked the activity to leaked credentials for approximately 74,000 Fortinet devices, including firewalls and VPN gateways. The NCSC said a threat actor leaked a database of credentials after brute-force, dictionary and credential stuffing attempts.

Fortinet published its own analysis on 19 June 2026. It said this is not a new vulnerability. CERT-EU reported that at least four organizations in Japan, Taiwan, Vietnam, Iraq and Turkey were compromised. The Canadian Centre for Cyber Security alert AL26-014 also advises a patch check for CVE-2025-59718 and CVE-2025-59719, the December 2025 SSO flaws that also appear in Fortinet FortiCloud SSO exploitation.

Timeline

  1. June 15, 2026

    A security researcher reports a credential harvesting campaign against exposed FortiGate SSL VPNs (per CERT-EU)

  2. June 17, 2026

    The Canadian Cyber Centre becomes aware of open-source reporting on FortiBleed

  3. June 18, 2026

    CISA publishes its alert urging hardening of Fortinet devices

  4. June 18, 2026

    The UK NCSC publishes its alert on global targeting of Fortinet firewalls and VPN gateways

  5. June 18, 2026

    The Canadian Cyber Centre issues Alert AL26-014

  6. June 19, 2026

    Fortinet publishes its PSIRT analysis of the reported credential compromise

  7. June 22, 2026

    CISA updates its alert to link Fortinet's guidance

  8. June 22, 2026

    CERT Vanuatu releases Advisory 149 rating the impact HIGH / CRITICAL

How the attack worked

Credentials, not a software flaw

Fortinet says the activity involves reuse of credentials from earlier incidents, plus brute-force attempts against devices with weak password hygiene and no MFA. It says this is not a new vulnerability. CERT Vanuatu calls it a credential compromise campaign, unlike a traditional software vulnerability.

Where the credentials came from

The NCSC describes brute-force, dictionary and credential stuffing attempts against FortiGate and VPN portals. CERT Vanuatu lists previous data breaches, infostealer infections and credential stuffing as sources of credentials. Sources differ in emphasis, and no source gives a single confirmed origin.

After login

Valid credentials make logins look normal. CERT Vanuatu says attackers may create admin accounts, reset passwords, disable logging and change firewall rules. Fortinet and the Cyber Centre tell customers to look for unrecognized accounts such as forticloud-sync and forticloud-tech, and to check for lateral movement.

Who says who was behind it

No public attribution. The NCSC refers to "a threat actor" and the sources reviewed name no group. Fortinet says the actor is reported to have breached other vendors' devices too.

Impact

CISA: leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and VPN gateways. The NCSC reports some indications of potential impact in the UK. CERT-EU reports at least four organizations in Asia and the Middle East were compromised. CERT Vanuatu rates the impact HIGH / CRITICAL. Fortinet says it is contacting impacted customers. Counts are from different sources and measure different things.

Government and regulator response

  • 18 June 2026: CISA urged customers to end all SSL VPN and admin sessions, reset passwords, confirm PBKDF2 storage, review logs, require phishing-resistant MFA and close public management access.
  • 18 June 2026: the NCSC advised checking for compromise, isolating and factory resetting affected devices, and checking other devices that share credentials. It pointed to its Early Warning service.
  • 18 June 2026: the Canadian Cyber Centre issued Alert AL26-014 with similar steps and a patch check for CVE-2024-55591, CVE-2025-59718 and CVE-2025-59719.
  • 19 June 2026: Fortinet published its analysis, said it had identified potentially compromised systems and was contacting impacted customers, and advised upgrades and MFA.
  • 22 June 2026: CISA updated its alert to link Fortinet’s guidance. CERT Vanuatu released Advisory 149.

Lessons

  1. Old credentials stay dangerous

    Fortinet says attackers reused credentials from previous incidents. A reset after one event must cover every credential that could have leaked.

  2. MFA on every remote login

    Fortinet ties the activity to devices with weak passwords and no MFA. CISA, NCSC and the Cyber Centre all call for MFA on VPN and admin logins.

  3. Do not expose management

    CISA and Fortinet both say to keep firewall administration off the public internet.

  4. Stored hashes matter

    CISA and the NCSC ask for PBKDF2 for admin credentials and removal of weaker legacy hashes.

  5. A password reset may not be enough

    The NCSC says a factory reset may be needed because the actor may have persistence.

  6. Edge devices share credentials

    The NCSC says to check other edge devices that share credentials with a compromised one.

What to check in your own organization

  1. Early warning

    Threat intelligence monitoring of exposed credentials could show that admin or VPN logins for your firewalls appear in leaked data. Watching vendor and government alerts, such as the 18 June 2026 notices, shows when to reset credentials. No promise of prevention.

  2. Inventory

    List every Fortinet device and confirm each one exists and belongs to you, as the NCSC advises.

  3. Management exposure

    Check that firewall administration is not reachable from the public internet.

  4. Accounts

    Look for unrecognized accounts such as forticloud-sync, forticloud-tech, forticloud, fortiuser and fortinet-support.

  5. MFA

    Confirm MFA is enforced on every VPN and admin login, ideally phishing-resistant.

  6. Password storage

    Confirm admin credentials use PBKDF2 and that admins have logged in again after the upgrade.

  7. Logs

    Review firewall, VPN, authentication and domain controller logs for unusual access and lateral movement.

Questions

What is FortiBleed?

The name used by CISA and others for a campaign using compromised credentials against internet-accessible Fortinet devices.

Is it a new Fortinet vulnerability?

Fortinet says no. It says it is not a new vulnerability and is not related to any recent incident or advisory.

How many devices were affected?

CISA says leaked credentials are associated with approximately 74,000 Fortinet devices. CERT-EU reports other figures for credential attempts, which measure something different.

Who is behind it?

No public attribution. The NCSC refers only to a threat actor.

What should customers do first?

End all active SSL VPN and admin sessions and reset all VPN and admin passwords, then enable MFA and review logs.

Did anyone suffer a confirmed breach?

CERT-EU reports at least four compromised organizations in Japan, Taiwan, Vietnam, Iraq and Turkey.

In our research

  1. Two Fortinet events of 2026: what to check October 2026
  2. What Is Credential Stuffing? Attackers Don’t Crack Passwords, They Buy Them April 2026

Sources

  1. CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure CISA
  2. Alert: NCSC issues advice following global targeting of Fortinet firewalls and VPN gateways UK National Cyber Security Centre
  3. AL26-014 FortiBleed leak of thousands of compromised credentials impacting Fortinet devices Canadian Centre for Cyber Security
  4. Analysis of Reported Credential Compromise of FortiGate Devices Fortinet PSIRT (affected vendor)
  5. Advisory 149: FortiBleed Widespread Credential Exposure Targeting Fortinet Firewalls and SSL VPN Gateways CERT Vanuatu
  6. Cyber Brief 26-07 June 2026 CERT-EU

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Leaked credentials

Leaked credentials are usernames, passwords or other login details that have become exposed outside the control of their owner.

Read more

Glossary term

Multi-factor authentication (MFA)

Multi-factor authentication (MFA) is a way to log in that needs two or more different kinds of proof, such as a password and a code from an authentication app.

Read more