Security researchers have reported a large-scale “FortiBleed” compromise involving exposed Fortinet/FortiGate firewall and VPN credentials. The incident could affect tens of thousands of devices worldwide. Review the Cybersecurity Threat Advisory now to protect your clients’ systems.
What is the threat?
FortiBleed refers to a reported large-scale exposure of Fortinet/FortiGate credentials associated with internet-facing firewalls and SSL VPN devices. Public reporting estimates that approximately 73,000 to 75,000 Fortinet device URLs across 194 countries may be affected.
The exposed dataset reportedly includes FortiGate firewall URLs, usernames, email addresses, plaintext passwords, and domain-related information. Additionally, reports suggest a multi-operator, Russian-speaking cybercriminal group may be conducting highly automated credential attacks against exposed Fortinet systems.
The campaign reportedly included credential testing at scale, brute-force attacks, historical credential leaks, infostealer data, and possible offline password cracking. Furthermore, current reporting suggests FortiBleed is a credential compromise and potential device-configuration exposure, not a single confirmed CVE. As a result, attackers may authenticate to FortiGate management interfaces or SSL VPN services when exposed credentials remain valid.
Why is it noteworthy?
FortiBleed is notable because it involves exposed credentials for perimeter security infrastructure rather than a traditional vulnerability tied to a specific CVE or CVSS score.
FortiGate firewalls and SSL VPNs often serve as primary administrative and remote-access entry points into enterprise networks. As a result, valid exposed credentials present a significant risk. Additionally, attackers often target these systems because they can provide direct access to critical network resources.
Furthermore, reports describe the activity as highly automated and potentially linked to a multi-operator, Russian-speaking cybercriminal group. This raises concerns that threat actors could quickly test and weaponize exposed credentials.
Consequently, successful attacks could give threat actors unauthorized access to VPN or firewall systems. They could then modify configurations, establish persistence, disable security controls, or use compromised devices as a foothold for further intrusion activity.
What is the exposure or risk?
The primary risk affects organizations that use Fortinet/FortiGate firewalls or SSL VPN services with internet-facing management or remote-access interfaces. In particular, risk increases when organizations have not rotated local credentials, do not enforce MFA, or run outdated FortiOS versions.
Because the reported FortiBleed dataset includes credentials and device access information, organizations should assume exposed accounts may be vulnerable to unauthorized use. Therefore, organizations should review privileged accounts and remote-access systems immediately. Attackers who successfully authenticate could access SSL VPN services, modify firewall settings, export configurations, create or change user accounts, weaken security policies, or establish persistence.
As a result, this access could give attackers a foothold for internal reconnaissance, lateral movement, data theft, ransomware deployment, or other follow-on attacks.
What are the recommendations?
Barracuda recommends the following actions to mitigate risk:
Immediate actions
- Check for exposure. Determine whether your organization appears in the FortiBleed dataset by using the Hudson Rock Fortinet exposure lookup page: https://www.hudsonrock.com/fortinet. This tool allows organizations to search their public domain (for example, company.com) to determine whether it appears in the reported data. Do not submit passwords, firewall configurations, internal hostnames, or other sensitive information. A positive match indicates that Fortinet/FortiGate credentials or related access data may be exposed. Organizations should immediately investigate and rotate affected credentials.
- Rotate Fortinet/FortiGate credentials immediately. This includes local administrator accounts, SSL VPN users, service accounts, API keys, and any credentials associated with FortiGate configurations. Because the reported exposure includes plaintext passwords and potentially configuration-derived data, credential rotation should be prioritized even if there is no evidence of active compromise.
- Restrict internet-facing management access. Disable public administrative access where possible and limit management interfaces to trusted IP addresses, internal networks, VPN-only access, or dedicated jump hosts. Reducing exposure limits opportunities for attackers to use leaked credentials or conduct additional credential-based attacks.
Additional protective measures
- Enable MFA for administrative and remote access. Enforce MFA for FortiGate administration, SSL VPN access, privileged accounts, and any externally accessible authentication path. MFA reduces the likelihood that attackers can gain access using exposed credentials alone.
- Review logs and configurations for suspicious activity. Look for unusual successful logins, spikes in failed login attempts, newly created or modified administrator accounts, unexpected VPN users, configuration exports, firewall policy changes, disabled logging, modified routes, or changes to authentication settings. Investigate any suspicious activity as a potential perimeter compromise.
- Update FortiOS and related Fortinet components. Upgrade to supported, current versions to reduce exposure to known vulnerabilities that could be leveraged alongside credential attacks. After updating, rotate credentials as appropriate and verify that management access, authentication controls, and logging settings remain properly configured.
References
For more in-depth information about the recommendations, please visit the following links:
- https://www.hudsonrock.com/fortinet
- https://cybersecuritynews.com/fortibleed-fortinet-firewalls-compromised/
- https://www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/
- https://doublepulsar.com/fortibleed-75k-fortinet-firewalls-have-admin-passwords-cracked-60299faa65f8?gi=3c659647a426
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
