In a joint advisory published on 6 October 2026, the FBI and the U.S. Secret Service said a campaign called FortiBleed is still targeting Fortinet firewalls and VPN gateways that are reachable from the internet. According to the advisory, most targets are critical infrastructure organisations.
How do the attackers get in?
FortiBleed does not rely on a new vulnerability; it gets in through passwords:
- Reused or leaked passwords from earlier breaches and info-stealer malware
- Password guessing against SSL VPN portals that are open to the internet
- Stealing the device’s user database and cracking passwords stored with an older method
That is why updating FortiOS alone is not enough. An organisation with weak or reused passwords is at risk even on an up-to-date device.
What happens after they get in?
According to reports, the attackers create new admin accounts, explore the internal network and Active Directory, and in some cases change the real administrators’ passwords so the organisation loses access to its own device. Security reports also describe ransomware groups getting in this way. The security company SOCRadar, citing the advisory, reports more than 86,000 compromised devices in 194 countries; this figure comes only from those reports and we have not verified it independently.
What should network administrators do?
Based on the recommendations quoted from the advisory in these reports:
- Close device management to the internet, or allow it only from specific addresses.
- End active admin sessions and change all VPN and admin passwords.
- Turn on multi-factor authentication for VPN and admin accounts.
- Check for unknown accounts, REST API keys and SSH access.
- Review firewall, VPN and domain controller logs for suspicious sign-ins.
- Make sure FortiOS admin passwords are stored with the newer method (PBKDF2) and FortiOS is up to date.
- Keep a separate, out-of-band way to recover the device.
If you run FortiGate or any other firewall and are not sure it is configured safely, see the network security and firewall service. For secure links between branches, the article on an IPsec tunnel between MikroTik and Cisco may help.
Photo: Premeditated, licensed under CC BY-SA 4.0, via Wikimedia Commons; cropped.
Source: FBI and U.S. Secret Service ↗
