Vulnerabilities · 84 days ago
FortiBleed has moved from exposure to reuse. The real break is a confirmed set of more than 86,000 working Fortinet logins that can be reused, sold, or pointed at specific targets, so patching the original flaws does not undo access already harvested.
Fortinet says the campaign is driven by reused credentials and brute-force attacks against weak password hygiene and no MFA, not a new Fortinet bug. The credentials cover FortiGate and SSL VPN environments in 194 countries, and the leak is now being formatted like eCrime inventory instead of a one-off dump.
That changes the threat from a leak around a vendor to direct entry into any network that still trusts a reused FortiGate or VPN password. The forward risk is focused intrusion, session abuse, and admin changes through working credentials that remain valid after the original issue is closed.
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: an Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet… EPSS 86% (100th percentile).
CISA federal remediation date Jan 30 · date passed
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS… EPSS 68% (99th percentile).
CISA federal remediation date Dec 23 · date passed
CVSS 9.8 CRITICAL: an improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through… EPSS 29% (98th percentile).
11 sources covering this story
⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
This week’s cybersecurity recap covers Firefox and Chrome bugs, EDR-killer tools, a TV botnet, an OpenBSD flaw, Android malware, Splunk exploitation
CISA urges device hardening after thousands of Fortinet credentials compromised
Security researchers warn of a months-long FortiBleed campaign targeting western organizations.
Global cybersecurity agencies warn of credential exposure in FortiBleed campaign targeting Fortinet firewalls and VPN gateways.
Fortinet Responds to FortiBleed Campaign
A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign.
NCSC Urges Fortinet Customers to Tackle FortiBleed Fallout
The NCSC has released guidance for Fortinet customers impacted by the FortiBleed threat campaign
CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices
FortiBleed attackers compromised 86,644 FortiGate devices using credential attacks, prompting CISA to urge password resets and MFA.
An update on FortiBleed — what’s happening with victim orgs
Attackers on internal networks, password cracked and other Friday fun.
Risky Bulletin: Creds for 74,000 Fortinet devices leaked
A LOT of Fortinet creds have leaked online, Canada’s spy agency allowed to remove a botnet from Canadian devices, a supply chain attack hi [Read More
Other noteworthy stories that might have slipped under the radar: Android TV botnet Popa linked to Israeli firm, Velvet Ant maintained decade-long stealth, unpatched GCP Config Connector flaw enables takeover.
FortiBleed: 86,000 Fortinet Device Credentials Compromised
The large-scale credential theft campaign hit roughly half of the internet-accessible Fortinet firewalls and VPNs.
CISA warns Fortinet users to secure devices after FortiBleed leak
Cybersecurity and Infrastructure Security Agency (CISA) urged Fortinet customers to secure their devices after nearly 74,000 firewall and VPN credentials were exposed in a data leak dubbed "FortiBleed."
FortiBleed: esposizione di credenziali SSL-VPN associate a dispositivi Fortinet esposti su Internet
Questo CSIRT ha recentemente rilevato la diffusione di un dataset riconducibile a una campagna denominata “FortiBleed”, contenente informazioni associate a dispositivi Fortinet/FortiGate esposti su Internet e utilizzati per l’accesso remoto tramite SSL-VPN.
Part of the PlainSec briefing for 2026-06-23