Fortinet FortiGate and SSL VPN Credential Harvesting Campaign “FortiBleed”

An active, large-scale credential harvesting campaign, known as “FortiBleed“, has been reported to target internet-facing Fortinet FortiGate firewalls and SSL VPN appliances. The campaign reportedly does not rely on a newly disclosed zero-day vulnerability. Instead, it uses credentials obtained from previous Fortinet-related breaches, infostealer malware logs, and credential reuse attempts against exposed FortiGate management interfaces and SSL VPN endpoints. If affected by this campaign, attackers could gain legitimate administrator access, resulting in full corporate network takeover, data theft, and ransomware deployment. System owners using Fortinet FortiGate firewalls or SSL VPN appliances are strongly advised to take immediate mitigation measures to reduce potential risks.

Vulnerability

• Fortinet FortiGate and SSL VPN Credential Harvesting Campaign “FortiBleed”
  • This campaign is a credential-based attack campaign targeting exposed Fortinet FortiGate management interfaces and SSL VPN services.

Severity Level

• High
• Critical for units with internet-facing FortiGate administrative interfaces or SSL VPN endpoints where administrator, VPN, SNMP, or pre-shared-key credentials have not been recently rotated.

Affected Products & Versions

• Fortinet FortiGate firewalls with internet-facing management interfaces.
• Fortinet SSL VPN appliances or SSL VPN services exposed to the internet.
• FortiGate devices using credentials that may have been exposed in previous breaches or infostealer malware logs.

Remediation

• Upgrade FortiOS: Upgrade all FortiGate devices to the minimum safe FortiOS version ASAP.
• Detect and Assess Exposure: Immediately check all public-facing FortiGate WAN IPs, management interfaces, and SSL VPN portals.
• Rotate Credentials and Enable PBKDF2 Hardening: Change all FortiGate administrator passwords, SSL VPN local user credentials, VPN pre-shared keys, and SNMP community strings.
• Block Scanning and Enable MFA: Block public HTTPS/SSH admin access, restrict admin access to trusted IPs, and enable MFA for all admin accounts.
• Audit Accounts and Treat Confirmed Compromise as Full Incident Response: If suspicious activity is found, preserve logs, isolate affected devices where appropriate, reset related credentials and initiate incident response procedures.

Reference

• Bleeping Computer: FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices
• Arctic Wolf: Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries
• SOC Radar: FortiBleed Breach How 30,000 Corporate Firewalls Were Quietly Compromised

Published on: 18 June 2026