FortiBleed: when the firewall falls to a password, not a bug

We usually picture firewall attacks as clever exploits of a software bug. The campaign security researchers call FortiBleed is a useful reminder that the easiest way through a locked door is often a copied key. On 6 October 2026 the FBI and the US Secret Service warned that it was still active, with more than 86,000 internet-facing Fortinet FortiGate firewalls and VPN gateways compromised in 194 countries.

What happened

There is no single vulnerability (CVE) behind FortiBleed, so there is no patch that fixes it. According to the advisory and the researchers tracking it, the attackers:

1. Scan the internet for exposed FortiGate SSL VPN login pages and management interfaces.
2. Try passwords leaked from other breaches (credential stuffing) and a few common passwords against many accounts (password spraying).
3. Once inside, copy stored password hashes and crack them offline to find more accounts.
4. Create new administrator accounts to keep access, and sometimes delete or change the real admins, locking the owners out of their own firewall.
5. Sell that access, including to ransomware gangs. At least a dozen victims were later hit with ransomware.

Fortinet is not uniquely at fault here. Any VPN or firewall from any vendor is exposed to the same approach if it accepts a username and password from the internet with nothing else.

Why this works so well

Edge devices sit at the boundary of the network, so they must be reachable. Their accounts are often set up years ago by a contractor, rarely reviewed, and sometimes shared. Many have local accounts with no multi-factor authentication (MFA), and management pages that were opened to the internet "temporarily" during an installation. A breached firewall is also hard to spot: it is the very device that should be watching for intruders.

The checks to run this week

If you look after a FortiGate, or any VPN gateway, work through this list:

• Close management to the internet. Admin pages (HTTPS and SSH) should only be reachable from a management network or a jump host, never from anywhere.
• Review every account. List all administrator and VPN users. Remove anything you do not recognise, accounts for people who have left, and shared or default accounts.
• Turn on MFA for VPN users and administrators. A stolen password alone should not be enough.
• Reset passwords and end sessions. The FBI advises resetting credentials and terminating all admin VPN sessions if there is any doubt.
• Check logs for logins from unexpected countries, many failed logins in a short time, and new admin accounts or configuration changes nobody requested.
• Keep firmware current anyway. It will not stop this campaign, but attackers often combine stolen passwords with old bugs.
• Back up the configuration somewhere offline so you can rebuild quickly if you are locked out.

Our notes on strong passwords and MFA and on firewalls, IDS and IPS explain the background, and the password generator helps you create long, unique admin passwords.

What to tell your manager

Keep it simple: "Attackers are taking over firewalls worldwide using leaked and guessed passwords, not a software bug. We have closed admin access from the internet, reviewed all accounts and turned on MFA. Here is what we found." Managers react well to a short summary that shows the risk, the action and the result.

The bigger lesson

Patching is essential, but identity is now the main battleground. The same steps that protect a firewall also protect email, cloud consoles and remote access tools: fewer exposed login pages, fewer accounts, MFA everywhere, and someone who actually reads the logs.

Sources

• The Record: FBI, Secret Service warn about FortiBleed
• eSecurity Planet: FBI warns FortiBleed attacks continue after 86,000+ devices compromised
• Infosecurity Magazine: FBI and Secret Service warn of FortiBleed lockout threat