FBI and USSS Warn of Ongoing FortiBleed Campaign Targeting Fortinet Devices
The FBI and U.S. Secret Service warn that the FortiBleed campaign continues targeting internet-exposed FortiGate firewalls and SSL VPN gateways. It is not a new vulnerability, but primarily the exploitation of leaked and weak credentials.
The FortiBleed campaign remains active following earlier warnings about credential exposure. In a joint warning dated October 6, the FBI and U.S. Secret Service (USSS) said attackers are globally searching for internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways and trying already compromised credentials against them.
According to the warning, they are not limited to testing access. There have been cases in which attackers created new administrator accounts or changed or deleted existing accounts. Legitimate administrators may therefore lose access to their own device.
The FortiBleed campaign targeting Fortinet devices focuses on credentials, not one new flaw
Fortinet said this is not a new product vulnerability. According to the manufacturer, the campaign uses older leaked passwords that have been reused, along with brute-force attacks against accounts with weak passwords or no multifactor authentication.
This is also important for administrators’ response: the situation cannot be resolved simply by installing a single firmware update. The risk primarily affects organizations that expose FortiGate or SSL VPN management to the internet and use weak, reused, or already compromised credentials.
The FBI and USSS refer to more than 86 644 compromised devices in 194 countries. However, this figure does not come from a new federal measurement. The authorities attribute it to verification by SOCRadar, so the exact current number of independently confirmed compromised devices cannot be determined from the public warning.
Taking over a firewall can create persistent access
Successful login to a network device may allow attackers to take over its management and maintain access by creating a new attacker account. Potential impacts include lateral movement within the internal network, configuration changes, administrators losing control of the device, and potentially a subsequent ransomware attack.
The joint warning states that access obtained through FortiBleed was also provided to the INC/Lynx and Payload ransomware partners. However, the public document does not specify the scope of such cases, the number of incidents, or the specific victims. It also does not confirm the identity of the campaign’s operators or their geographic or state affiliations.
Recommended steps for Fortinet device administrators
The FBI, USSS, and Fortinet recommend treating the situation as a possible compromise, rather than merely performing routine maintenance. The listed measures include:
- terminating active VPN and administrator sessions,
- resetting passwords, especially for accounts where credentials may have been reused,
- deploying phishing-resistant multifactor authentication,
- restricting device management from the public internet,
- reviewing configuration, administrator accounts, API keys, and system logs,
- searching for logins from unusual IP addresses and changes that administrators cannot explain.
Unknown administrator accounts and changes to existing accounts deserve particular attention. The warning directly describes situations in which attackers changed or deleted original accounts to prevent victims from managing the device.
What to watch next
Further information may come from the FBI, USSS, CISA, or Fortinet, particularly if they publish new indicators of compromise, confirmed victims, or a more precise scope of the activity. For FortiGate and SSL VPN operators, however, the immediate task is to check whether they have publicly accessible management interfaces, weak or reused passwords, and unknown changes to accounts or configuration.
Sources
- FBI / U.S. Secret Service – FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts – The primary joint warning from October 6, 2026, confirms continued activity and describes techniques, indicators, reported account lockouts, and recommended mitigations.
- Fortinet – Analysis of Reported Credential Compromise of FortiGate Devices – The manufacturer’s statement that this is not a new vulnerability, along with recommendations for resetting credentials, MFA, updates, and restricting management over the internet.
- CISA – CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure – Corroborates an earlier government warning about compromised credentials and recommendations for hardening, log review, PBKDF2, and MFA.
- The Record – FBI, Secret Service add to warnings of FortiBleed credential stealing campaign – Independently reports on the new federal warning and its practical significance for Fortinet device users.
Verified and updated: 10/07/2026 15:25
