FortiBleed Breach Compromises 86,644 Fortinet Firewalls (2026)

Key Takeaways

• FortiBleed harvested 86,644 working administrator and VPN credentials from internet‑facing FortiGate firewalls, affecting roughly half of all exposed Fortinet devices across 194 countries.
• The campaign relied on existing weaknesses—legacy SHA‑256 password hashes, weak passwords, and exposed management interfaces—rather than a new zero‑day vulnerability.
• Attackers used two main techniques: exfiltration of configuration files to crack hashes offline, and a custom “FortiGate Sniffer” implant that captured plaintext VPN credentials from trusted appliances.
• Brute‑force and credential‑validation activity generated over 1.1 billion login attempts against FortiGate targets and 2.1 billion against Microsoft SQL Server hosts, demonstrating the operation’s industrial scale.
• The stolen credentials fed ransomware operations (INC and Lynx), with at least 12 confirmed ransomware deployments traced back to the compromised firewalls.
• Mitigation requires immediate session termination, credential reset, phishing‑resistant MFA, upgrade to PBKDF2‑based FortiOS versions, and removal of management interfaces from the public internet.

What Is FortiBleed?
FortiBleed is the name given to a large‑scale credential‑harvesting campaign that has been collecting, cracking, and cataloguing login data from FortiGate firewalls and SSL VPN gateways since at least February 2026. Researchers first spotted an internet‑exposed server holding downloaded FortiGate configuration files, harvested credentials, and the tools used to crack password hashes and run credential‑stuffing attacks. By mid‑June 2026 the confirmed tally of working credentials had risen to 86,644—valid, currently usable logins for perimeter appliances that act like tested keys to tens of thousands of front doors. Unlike a simple dump of stale passwords, this dataset was validated, sorted by country, industry, and even organization revenue, turning routine leakage into a systemic threat. The name echoes the 2023 “Citrix Bleed” incident, highlighting that edge devices remain a favored target for attackers.

How the FortiBleed Attack Chain Works
The campaign’s success stemmed from a patient, low‑noise approach rather than exploiting a fresh vulnerability. Two techniques drove most of the compromise: (1) exfiltration of FortiGate configuration files paired with offline SHA‑256 hash cracking, and (2) deployment of a custom traffic‑sniffing implant on already‑compromised devices. By harvesting configuration files through old vulnerabilities, phishing‑obtained logins, or reused passwords, attackers gained access to stored administrator password hashes. Those hashes were then cracked at industrial scale using a 45‑GPU cluster managed via Hashtopolis, turning even “strong” eight‑character passwords into crackable targets within hours. On devices they already controlled, the operators installed a bespoke packet‑sniffing tool nicknamed “FortiGate Sniffer.” Running directly on the firewall, it intercepted SSL VPN authentication and other credentials straight from network traffic, capturing plaintext logins as legitimate users signed in. Because the tool resided on a trusted appliance, it generated almost no conventional alerts, allowing the campaign to expand stealthily from device to device.

Config Exfiltration and SHA‑256 Hash Cracking
FortiOS historically stored administrator passwords as SHA‑256 hashes, an algorithm that modern GPUs can process extremely fast. Although Fortinet migrated to PBKDF2‑based hashing in FortiOS 7.2.11, 7.4.8, and 7.6.1, existing administrator passwords remain stored as legacy SHA‑256 hashes until each admin logs in again after an upgrade. Consequently, countless upgraded‑but‑not‑fully‑rotated devices retained crackable hashes long after the “fix” shipped. The FortiBleed operators exploited this gap, cracking the hashes offline and feeding the recovered passwords into their credential database. Security researcher Volodymyr “Bob” Diachenko described the workflow as intercepting SSL VPN authentication, cracking hashes on the GPU rig, and pivoting into internal Active Directory environments.

The ‘FortiGate Sniffer’ VPN Interceptor
On already‑compromised firewalls, the attackers planted the “FortiGate Sniffer,” a custom packet‑sniffing tool that runs directly on the appliance. It captures SSL VPN authentication traffic in real time, extracting plaintext usernames and passwords as legitimate users connect. Because the sniffer operates on a trusted device, it blends with normal traffic and evades most endpoint detection and response (EDR) tools that monitor endpoints or servers. Each newly captured credential is added to the searchable database, enabling the campaign to grow without triggering traditional alarms.

The Numbers: 194 Countries, 320,000 Targets, 1.16 Billion Login Attempts
The sheer scale of FortiBleed prompted a coordinated government response. Researchers observed roughly 1.16 billion credential‑validation attempts against more than 320,000 FortiGate targets, while the same infrastructure generated 2.1 billion brute‑force attempts against 160,000+ Microsoft SQL Server hosts—showing the crew’s broad focus. Kevin Beaumont’s Shodan‑based analysis estimated that the leaked set represents about 15 % of all internet‑facing Fortinet firewalls, or roughly half of the devices that are actually exposed when accounting for overlapping scans. The data spanned 194 countries, impacted 845 partner organizations identified by Huntress, and included configuration files from over 73,000 devices. Campaign activity has been traced back to at least February 2026.

Fortinet’s Response: ‘This Is Not a New Vulnerability’
Fortinet issued a PSIRT blog post on June 19 2026 stating unequivocally that “this is not a new Fortinet vulnerability, and this activity is not related to any recent incident or advisory.” The vendor attributed the breach to threat actors reusing credentials from prior incidents (referencing advisories FG‑IR‑26‑060 and FG‑IR‑25‑647) combined with brute‑force attacks on devices lacking strong passwords and multi‑factor authentication. Fortinet’s mitigation checklist includes terminating all admin and VPN sessions, resetting every credential, enforcing phishing‑resistant MFA, upgrading to FortiOS 7.4/7.6/8.0 for PBKDF2 hashing, validating configurations for unauthorized changes, and restricting external management access. While technically accurate—no unpatched flaw powered FortiBleed—the response overlooks that legacy SHA‑256 hashes persisted by design after upgrades and that internet‑facing management interfaces have long been a default setting many administrators never locked down.

CISA and NCSC Sound the Alarm
Government agencies acted swiftly. On June 18 2026, CISA released an advisory urging immediate hardening of Fortinet environments, while the UK’s NCSC published a parallel global warning. The rapid issuance of three major advisories within a week underscores how central Fortinet appliances are to critical infrastructure, government networks, and the enterprise mid‑market. Ensar Seker, CISO of SOCRadar, emphasized the systemic risk: “If attackers obtain valid credentials for firewalls, VPN gateways or administrative interfaces, they can bypass many traditional security controls and gain direct access to internal environments.” Both agencies’ recommendations mirror Fortinet’s: kill active sessions, rotate credentials, adopt PBKDF2 password storage, enable phishing‑resistant MFA, and lock down management access to trusted networks only.

The Ransomware Connection: INC and Lynx
FortiBleed is not merely a credential‑harvesting exercise; it feeds ransomware operations. Investigators found an operator logged into both the INC Ransom and Lynx ransomware negotiation panels, and victims listed on INC’s leak site overlapped with organizations appearing in the FortiBleed data. The crew turned stolen firewall access into double‑extortion attacks, achieving admin‑level access on 409 targets and completing the attack chain on 354 of them. From that foothold between 12 confirmed ransomware deployments followed, encrypting hundreds of endpoints across affected companies. The operators reportedly prioritized NATO‑linked organizations, government entities, and critical‑infrastructure providers, blurring the line between financially motivated crime and espionage.

Why Perimeter Appliances Are the New Soft Target
FortiBleed reflects a broader shift: attackers are moving away from endpoints and focusing on the network edge. Firewalls, VPN concentrators, and secure gateways sit outside the reach of most endpoint detection and response (EDR) tools, run proprietary operating systems that resist inspection, and are frequently left unpatched because taking them offline disrupts business. A single compromised firewall can expose an entire corporate network, whereas a compromised laptop usually affects only one user. When attackers can validate 86,644 firewall logins in one campaign, the return on investment is enormous. Moreover, because these devices are trusted implicitly, a login from a stolen credential rarely triggers the behavioral alerts that would fire if the same attacker appeared on a domain controller. This dynamic makes perimeter appliances ideal beachheads for large‑scale intrusion.

FortiBleed in Context: Fortinet’s History of Exploited Flaws
The availability of 86,644 crackable hashes stems from a recurring pattern of critical Fortinet vulnerabilities over the past four years. Each mass‑exploitation event—CVE‑2022‑40684, CVE‑2023‑27997 (XORtigate), CVE‑2024‑21762, and CVE‑2024‑55591—handed attackers fresh configuration files and credentials that later became raw material for FortiBleed. Although each flaw was patched quickly, patching does not automatically rotate the credentials or configuration data that leaked while the device was vulnerable. Thus, an attacker who grabbed a config file during a 2024 SSL‑VPN exploitation window could still be cracking and using those hashes in 2026 if the admin never changed the password. Vulnerability management fixed the door; nobody changed the locks.

Market Impact: Enterprise Security and Fortinet’s Standing
Fortinet supplies millions of firewalls to a customer base ranging from small businesses to national governments. An incident affecting roughly half of its internet‑facing installed base is therefore a market event as much as a security one. Procurement teams that standardized on FortiGate for cost and performance now face board‑level questions about concentration risk—the danger of betting an entire security architecture on a single vendor’s edge appliance. The fallout may accelerate two existing trends: a shift toward secure access service edge (SASE) and cloud‑delivered security, which reduces reliance on physical VPN concentrators that store crackable configuration files, and a renewed push for identity‑centric zero trust, where a valid credential alone is insufficient—continuous verification, device posture, and phishing‑resistant MFA gate every session. Vendors such as Zscaler, Cloudflare, and Palo Alto’s Prisma line stand to gain from Fortinet’s discomfort. For Fortinet, the reputational challenge is to convince customers that the breach stems from misconfiguration rather than a product defect, while also implementing more secure defaults, automated credential‑rotation prompts after upgrades, and aggressive MFA enforcement.

How to Detect and Mitigate FortiBleed
Because FortiBleed hinges on valid credentials, the remediation priority is unambiguous: assume compromise, rotate everything, and enforce MFA before hunting for indicators. Any FortiGate that has ever been internet‑exposed or ran a vulnerable FortiOS build during past exploitation windows should be treated as potentially compromised. The following priority checklist distills guidance from Fortinet, CISA, and independent responders:

• Terminate all admin & SSL VPN sessions – Immediate; evicts any attacker riding a stolen live session.
• Reset every admin, local and VPN credential – Immediate; invalidates cracked/leaked passwords in the FortiBleed set.
• Enforce phishing‑resistant MFA – Immediate; a stolen password alone can no longer authenticate.
• Upgrade to FortiOS 7.4 / 7.6 / 8.0 (PBKDF2) – High; replaces crackable legacy SHA‑256 hash storage.
• Remove management interface from the internet – High; shrinks the attack surface the campaign scans.
• Audit configs for unauthorized changes / new accounts – High; detects persistence, rogue admins, and altered policies.
• Review logs for impossible‑travel & off‑hours logins – Medium; surfaces credential misuse that looks “legitimate.”

Rotating credentials involves checking the FortiOS version, reviewing admin accounts, forcing password resets, restricting login sources via trusthost, terminating active SSL VPN tunnels, and inspecting authentication logs. For detection, defenders should monitor for admin or VPN logins from unfamiliar countries or hosting‑provider IP ranges, unexpected new accounts or privilege changes, configuration drift such as new port forwards or disabled logging, and any sign of the “FortiGate Sniffer” implant. Feeding FortiGate logs into a SIEM makes these patterns far easier to spot than manual review.

Competitive Fallout: Palo Alto, Cisco and the SSL VPN Reckoning
FortiBleed does not absolve other vendors; it indicts an entire product category. In the past 24 months, Cisco, Palo Alto Networks, Citrix, Ivanti, and SonicWall have all patched critical, actively exploited flaws in VPN and firewall products. The 2023 “Citrix Bleed” episode that FortiBleed’s name references saw NetScaler devices harvested at scale, and Ivanti’s Connect Secure gateways became synonymous with edge‑device compromise. The pattern is a systemic problem, not a single‑vendor failure. Still, market perception rewards whoever was not in the latest headline. Palo Alto Networks and Zscaler are likely to lean into FortiBleed in competitive sales cycles, emphasizing cloud‑delivered security and identity‑first architectures that never expose a crackable on‑box configuration file. Expect “get off legacy SSL VPN” to become a dominant marketing theme through the rest of 2026, echoing guidance many agencies have quietly pushed for years. The deeper reckoning is architectural: SSL VPN was designed for a world where the network perimeter meant something. In a cloud‑first, work‑from‑anywhere environment, funneling every remote user through an internet‑facing appliance that stores administrative secrets is increasingly indefensible. FortiBleed may be remembered less as a Fortinet story and more as the moment the industry finally accepted that the legacy VPN concentrator is a liability whose time has passed.

What Happens Next: 5 Predictions for Perimeter Security
Based on the campaign’s trajectory, ransomware overlap, and coordinated government response, five developments merit watching through the remainder of 2026 and into 2027:

1. A wave of downstream ransomware. With INC and Lynx already deploying encryptors from FortiBleed access, expect additional intrusions and extortion events as buyers work through the 86,644‑credential set before defenders finish rotating credentials.
2. Mandatory MFA and secure defaults from Fortinet. Look for FortiOS updates that force credential rotation after upgrades, prompt for PBKDF2 migration, and enable MFA by default on management interfaces—closing the exact gaps FortiBleed exploited.
3. Regulatory and insurance pressure. Cyber‑insurers are likely to add explicit questions about internet‑exposed management interfaces and legacy hash storage, and edge‑device hygiene will feature in future CISA binding directives.
4. Accelerated SSL VPN retirement. Enterprises will fast‑track migrations to zero‑trust network access and SASE, treating always‑on VPN concentrators as legacy tech to be decommissioned rather than merely patched.
5. More “‑Bleed” campaigns by name. The success of branding a credential‑aggregation campaign will inspire copycats against other edge vendors, as researchers and criminals alike learn that packaging old leaks into a searchable database is cheaper and quieter than burning a zero‑day.

The Bottom Line on the Fortinet Credential Compromise
FortiBleed is a discipline story masquerading as a breach story. No zero‑day, no exotic malware, no nation‑state exploit chain—just leaked credentials, legacy SHA‑256 hashes, and poor hygiene, industrialized into a searchable database that placed half the internet’s Fortinet firewalls at risk. The 86,644 compromised logins are a symptom; the underlying disease is the enduring assumption that a perimeter appliance is trustworthy simply because it is the thing enforcing trust. For every organization running a FortiGate, the prescribed response is uniform regardless of whether the device appears in the leak: terminate all sessions, reset every credential, enforce phishing‑resistant MFA, upgrade to PBKDF2‑capable FortiOS, and remove the management interface from the public internet. For the wider industry, FortiBleed delivers the clearest signal yet that identity—not the firewall—is the true perimeter now.