CISA Warns of Active Exploitation Following FortiBleed Leak

Pierluigi Paganini
June 20, 2026

FortiBleed exposed credentials for 74,000 Fortinet devices, with attackers actively exploiting the leak to target systems worldwide.

On June 18, CISA issued an emergency alert after reports surfaced that credentials for approximately 74,000 Fortinet firewalls and VPN gateways had been leaked in what researchers are calling FortiBleed. The agency confirmed that threat actors were actively using those credentials to target internet-accessible Fortinet devices across government and private-sector organizations worldwide.

“CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials.” reads the alert published by CISA. “This activity, referred to as FortiBleed, involves the exposure of leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network (VPN) gateways.”

This week, the security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted about it on LinkedIn. Kevin Beaumont, one of the most trusted independent voices in network security, then obtained the dataset, worked through it with Hudson Rock, and confirmed what nobody wanted to hear.

“Massive Fortinet/FortiGate bruteforce/active exploitation campaign uncovered in action. Thousands of top vendors instances are listed in the files like this (see screenshot). This one alone has 21,634 domain names – from Chevron to Fortinet itself. All – with potentially working passwords to the FortiGate appliances obtained through various menas.” Bob Diachenko wrote on LinkedIn.
“Crooks use sophisticated hashcracking approach to get then plaintext passwords from the Fortigate configs and use them consequently in the internal network movement and takeover.”

The popular cybersecurity expert Kevin Beaumont confirmed that the data is legit and is related to around 75k devices.

“The data is legit. It is around 75k devices. Almost all are still online, and Fortinet devices. It appears to be recent data.” reads the analysis published by Beaumont. “The data appears to have come from exports of config from the devices, as it includes things which are only visible from the device itself.”

Beaumont verified credentials at multiple organizations in the dataset personally and found them working. The IP addresses in this collection are largely different from the 2025 Belsen Group leak, which covered 15,000 devices. That earlier dump was old data from a 2022 zero-day. This one isn’t.

Based on Shodan polling, the FortiBleed dataset covers roughly 50% of all Fortinet firewall devices currently facing the internet.

“In a majority of cases, the Fortigate Management Interface is exposed to the internet on impacted devices.” states the expert.

According to Hudson Rock’s analysis, the 73,932 unique firewall URLs span 194 countries and 21,632 unique domains. Names appearing in the dataset according to Hudson Rock include Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle, and numerous government agencies and critical infrastructure operators. One entry in Diachenko’s screenshots alone listed 21,634 domain names, including Chevron and Fortinet itself.

Diachenko’s investigation went further after he found the attackers had accidentally left an open directory containing their own tooling, scripts, connection strings, logs, and analytics. What he found inside suggests a Russian-speaking multi-operator threat group conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets, plus 2.1 billion attempts against 163,650 Microsoft SQL Server systems.

The group reportedly intercepted SSL VPN authentication hashes and cracked them using a 45-GPU cluster managed through Hashtopolis. Multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were described as fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedly stolen.

The data appears to have come from exported device configurations rather than a simple credential scrape. That’s a meaningful distinction: config exports contain information you can’t get just by intercepting login traffic, which points toward actual device access at some point. How that access was obtained remains unknown: it may be one of the many documented Fortinet CVEs, or it may be something new.

One detail in the dataset that stands out is the business intelligence layer. Each entry includes the company’s industry, revenue, employee count, and country, formatted in a way Beaumont describes as very common in criminal markets for selling initial access. This wasn’t assembled for personal use. It was assembled for sale or coordinated deployment across a team. The attached comments on each target are essentially a sales catalog.

That means an attacker with these credentials can log in remotely, gain access to the firewall and therefore the network behind it, change security settings, and create backdoor admin accounts. Beaumont also noted that Fortinet moved to PBKDF2 credential storage in early 2025 firmware updates, but only for devices where admins had actually logged in after applying the update. Many devices were still storing passwords as SHA-256 with salt, which is crackable via brute force from a stolen config file.

Hudson Rock has published a free lookup tool at hudsonrock.com/fortinet where organizations can check if their domain appears in the dataset.

” It is unclear where Hunt Intelligence obtained the data from and how long it has been in circulation, however it is formatted in a way which looks like an eCrime gang — e.g. it lists the type of company, their revenue and country.” concludes Beaumont. “This is a very common format in eCrime circles when selling initial access information.”

CISA’s instructions are direct and non-negotiable for any organization running Fortinet equipment. Terminate all active SSL VPN and administrative sessions immediately. Reset every VPN and administrative password. Enable phishing-resistant multi-factor authentication on all admin interfaces. Review logs for unauthorized access or lateral movement.

Upgrade to the latest FortiOS release and have every admin log back in to trigger the re-hashing of stored credentials to PBKDF2. Remove the FortiOS management interface from public internet access unless absolutely necessary, and delete any unauthorized accounts.

If you see unexpected successful logins to admin accounts, don’t assume it was a mistake. Assume the device is compromised and consider replacing it, because the attackers may have already modified its configuration or planted backdoor accounts that persist through credential rotation.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon