Back Securityaffairs.Co

FortiBleed Exposes Admin Passwords for 75,000 Fortinet Firewalls

Securityaffairs.Co •Pierluigi Paganini • June 18, 2026

FortiBleed: Admin Passwords for 75,000 Fortinet Firewalls Are Out in the Wild. Half the Internet-Facing Fortinets on the Planet. Security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

FortiBleed Campaign Compromises 75,000+ Fortinet Devices Globally A credential-harvesting campaign known as 'FortiBleed' has compromised over 75,000 Fortinet firewalls and VPNs across 194 countries. The attackers, suspected to be Russian-speaking cybercriminals, exploited previously leaked credentials and conducted over 1.16 billion credential attempts against FortiGate devices. The exposed dataset includes verified usernames and passwords for major corporations and government agencies, allowing potential unauthorized access to sensitive networks. Researchers identified the campaign's extensive reach, with significant impacts on sectors such as telecommunications, healthcare, and government. The operation is ongoing, with automated tools continuously testing the compromised credentials. Security experts emphasize the need for immediate password changes and enhanced security measures. Fortinet acknowledged the situation but stated it was not linked to any recent vulnerabilities. 105 sources 75

Extracted Entities

FortiBleed Exposes Admin Passwords for 75,000 Fortinet Firewalls

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Companies (1)