FortiBleed Campaign Targets Firewalls Worldwide

THREAT INTELLIGENCE

Peer Review

4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.

ISO 27001 text with a globe outline symbol on a black background.

2025 winner badge for Cyber Security Excellence Awards with gold and black design.

Fortinet

June 18, 2026

Executive Summary

Large-scale automated credential abuse campaign targeting Fortinet devices using leaked, reused, or default credentials.

Key Details

Affected Platform

Fortinet

Attack Surface

Recommended Action

Affected Environment

Fortinet FortiGate firewalls and VPN appliances with internet-exposed management interfaces across all sectors globally.

Operational Impact

Attackers intercept traffic, harvest credentials, extract firewall rules and VPN configs, and maintain long-term persistence.

Technical Root Cause

Weak, reused, or default credentials without MFA; older password hashing standards (non-PBKDF2) in FortiOS.

Recommended Mitigation

Restrict management interface exposure, upgrade FortiOS, enforce MFA on all admin and external gateway interfaces immediately.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Explore Threat Hunting

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

HackRead – FortiBleed attack on Fortinet firewalls via credentials. Hudson Rock – FortiBleed 75,000 Fortinet firewalls compromised. Hudson Rock – Fortinet lookup portal.