FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs

Cybersecuritynews •Abinaya • October 7, 2026

The FBI and U.S. Secret Service have issued a joint cybersecurity advisory warning that the ongoing FortiBleed campaign is targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways worldwide. The credential-compromise operation has reportedly affected more than 86,644 devices across 194 countries, creating a major risk for organizations that expose Fortinet management or remote-access services […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiBleed Campaign Locks Out Admins, Compromises 86,644 Fortinet Devices The FBI and U.S. Secret Service have issued a warning regarding the ongoing FortiBleed campaign, which targets internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This credential-harvesting operation has compromised over 86,644 devices across 194 countries, exploiting reused or leaked credentials and legacy SHA-256 password storage. Attackers utilize techniques such as credential stuffing and password spraying to gain access, subsequently creating new administrative accounts while deleting or changing existing ones, resulting in lockouts for legitimate administrators. The campaign has been linked to ransomware affiliates, including INC/Lynx and Payload. Investigators noted that the attackers' infrastructure was partially exposed due to poor operational security, revealing their methods and tools. Remediation for affected organizations may require more than standard patching and password resets. The advisory emphasizes the importance of implementing multifactor authentication and reviewing user accounts for unauthorized changes. 20 sources 72

Extracted Entities

FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs

The full story

Extracted Entities

Campaigns (1)

Companies (1)

Platforms (1)