Who this is for: anyone who runs FortiGate (Fortinet's firewall and VPN appliance) in house or has it run by a contractor. This page is based on public information from Fortinet, CISA, JPCERT/CC, Singapore's CSA, the FBI and the U.S. Secret Service. It does not cover how the attacks work and does not list attacker IP addresses.
続報待ち：この記事は公式発表に合わせて更新します
As of October 26, 2026 (JST)まだ分かっていないこと
- How the credentials were first obtained (Fortinet attributes it to reuse from previous incidents and brute-forcing)
- How many organizations in Japan were affected, and which
- Progress of Fortinet's direct outreach to customers
CISA published on June 18, Fortinet on June 19 and JPCERT/CC on June 23. On October 6, the FBI and the U.S. Secret Service warned that the attacks continue. We will update this page when new information is published.
What to do today
End admin and VPN sessions, then change passwords
Terminate all active administrative and SSL VPN sessions. Then change every admin and VPN password, especially on internet-facing devices (Fortinet, CISA, FBI). If the same password was used for other services, change those too (this site's recommendation).
Enforce multi-factor authentication
Enable multi-factor authentication on every admin and VPN account. CISA and the FBI ask for phishing-resistant methods (passkeys and hardware security keys qualify). See Choosing MFA the right way for how to choose.
Take the management interface off the internet
The FBI lists three levels: restrict access to trusted hosts (good), restrict it with a local-in policy (better), or remove internet administration altogether (best). Aim for the best.
Upgrade firmware and keep only PBKDF2
Fortinet recommends the latest 7.4, 7.6 or 8.0 release. PBKDF2 (a password storage method that is slow to crack) is available from 7.2.11, 7.4.8 and 7.6.1. A password change still leaves a legacy SHA-256 copy in the configuration, so remove it following Fortinet's technical guidance. The section below explains how.
Check configuration and accounts
Compare the configuration with a known-good copy and look for unknown admin accounts, VPN users and changes. Fortinet asks you to watch for accounts with names that imitate its support (for example, forticloud). The FBI also asks you to review REST API keys and remove any you do not recognize.
Review logs
Check admin logins, configuration exports and VPN login sources. If FortiGate is connected to Active Directory or LDAP, treat the integration account as compromised and review domain controller logs too (Fortinet, JPCERT/CC). If anything looks wrong, isolate the device, preserve the records, and contact Fortinet support or your national CERT.
Are you affected? A quick check
| Situation | This site's assessment |
|---|---|
| The FortiGate management interface or SSL VPN is reachable from the internet | Assume you are affected and do every step above |
| Firmware is already on a fixed version | Passwords still need to change (credentials leaked) |
| Running a version before 7.2.11, 7.4.8 or 7.6.1 | PBKDF2 is not available; plan an upgrade to 7.4 or later |
| A lookup tool did not find you | Do not take it as reassurance (registrations made by contractors may not show under your domain) |
| A contractor runs the device | Confirm with them that passwords were changed, MFA is on and logs were reviewed |
| You have site-to-site VPNs with other companies | Consider the impact if the other side is compromised (JPCERT/CC) |
What happened (from public agencies and Fortinet)
June 18, 2026
CISA urged organizations to harden Fortinet devices, citing global reports that credentials associated with about 74,000 Fortinet devices (firewalls and VPN gateways) had leaked. On June 22 it added a link to Fortinet's guidance.June 19, 2026
Fortinet published its analysis. It said this is not a new vulnerability and that the activity likely involves reuse of credentials from previous incidents and brute-forcing of devices with weak passwords and no MFA. It said it was contacting potentially affected customers.June 22, 2026
Singapore's Cyber Security Agency (CSA) warned that credentials of over 70,000 FortiGate devices had leaked.June 23, 2026
JPCERT/CC issued an alert (JPCERT-AT-2026-0019), saying it had confirmed that the data includes information related to Japanese companies.October 6, 2026
The FBI and the U.S. Secret Service issued a joint advisory (JCSA-20261006-01): the activity continues, some administrators have been locked out, and the access has been used as an entry point for ransomware.
- Type
- Leaked credentials and logins using them. No new CVE (Fortinet says it is not a new vulnerability)
- Targets
- Internet-facing FortiGate firewalls and SSL VPN gateways
- Scale
- CISA: about 74,000 devices. The FBI and JPCERT/CC cite a private security company's count of more than 86,644 devices in 194 countries
- Fortinet's view
- Not a new vulnerability. Reuse of credentials from previous incidents (Fortinet advisories FG-IR-26-060 and FG-IR-25-647) plus brute-forcing
- FBI's description
- Logins with leaked credentials and infostealer logs, offline cracking of password hashes taken from devices, and new admin accounts created to keep access
- Japan
- JPCERT/CC confirmed that the data includes information related to Japanese companies
The two advisories Fortinet cites as previous incidents cover authentication bypass flaws in FortiCloud single sign-on (FG-IR-25-647: CVE-2025-59718 and CVE-2025-59719; FG-IR-26-060: CVE-2026-24858). Both are known to have been exploited. Fortinet asks customers to confirm that the remediation steps in those advisories are complete. For FortiOS, FG-IR-26-060 is fixed in 7.6.6, 7.4.11, 7.2.13 and 7.0.19.
Why upgrading does not end it
This is the point this site most wants to make. Fixing a vulnerability usually ends with installing the fixed version, but here what leaked are the passwords themselves. If configuration files or credentials were taken while an older flaw was open, those passwords keep working after you upgrade.
JPCERT/CC explains that FortiGate configuration files contain hashes of admin passwords (values transformed so they cannot be reversed directly), so if a configuration file was taken, the passwords can be cracked offline without access to the device. The FBI likewise says reused credentials and the legacy SHA-256 storage let the attackers collect and crack authentication data at scale.
Not enough
- Upgraded firmware, but the passwords are unchanged
- Changed passwords, but the legacy copies remain
- No MFA, and the management interface is open to the internet
- Fixed FortiGate, but did not look at the connected Active Directory
Go this far
- Change every admin, VPN and integration account password
- Remove the legacy copies so that only PBKDF2 remains
- Enforce MFA and close the management interface
- Check accounts, API keys and logs
1. Credentials leak
Earlier incidents, reuse, brute-forcing
2. Login to admin or VPN
Stop it: MFA, close the management interface
3. Spread inside
Stop it: check accounts and logs, review AD integration
Removing the legacy password copies (keeping only PBKDF2)
According to Fortinet's technical guidance, PBKDF2 is available from 7.2.11, 7.4.8 and 7.6.1. Earlier versions store SHA-256. After an upgrade, each admin's password stays in SHA-256 until that admin logs in once.
In addition, even after a password change, the previous SHA-256 hash is kept for backward compatibility in a hidden field (old-password) in the configuration. Logging in does not remove it. To remove it, after every admin has logged in on the new version (and admins who have not logged in have had their passwords changed), enable the setting from Fortinet's guidance (login-lockout-upon-weaker-encryption on 7.6 and later, login-lockout-upon-downgrade on 7.2 and 7.4).
Check before you enable it
Fortinet's guidance says that after enabling this setting, downgrading to a version without PBKDF2 support locks administrators out. Enable it only after every admin has logged in or had their password changed, and when you have no plan to downgrade.
For how password storage methods differ, see What is password hashing?.
If you are locked out or suspect a compromise
The FBI describes cases where attackers created new admin accounts and then deleted the original admin accounts or changed their passwords, locking the owners out. A password reset alone does not recover from that.
If a compromise is suspected, the FBI asks organizations to isolate the device and collect logs, configuration and other records before acting. Fortinet says to treat the device as compromised and follow its recovery guidance. Singapore's CSA suggests considering a factory reset if persistence is suspected, after collecting the records first, because a reset destroys them.
For what happens when this turns into ransomware, see What is ransomware. For defending VPN devices in general, see How to defend VPN devices and remote access.
What is still unknown
| Item | Status |
|---|---|
| Whether it is a new vulnerability | Not a new vulnerability (Fortinet) |
| Whether attacks continue | Continuing (FBI and U.S. Secret Service, October 6) |
| How the credentials were first obtained | Fortinet attributes it to reuse from previous incidents and brute-forcing; not fully established |
| Whether the leaked data is still usable | JPCERT/CC says some researchers point out it may include credentials that are still valid, and that it should not be treated only as recirculated old data |
| Affected organizations in Japan | Confirmed to be included (JPCERT/CC); number and names not published |
| Number of resulting incidents (ransomware and others) | Not published |
Neither the public agencies nor Fortinet have named the affected organizations. This site does not speculate about specific organizations.
Sources
- Fortinet PSIRT, "Analysis of Reported Credential Compromise of FortiGate Devices" (June 19, 2026) — fortinet.com
- Fortinet, "Technical Tip: Enforcing PBKDF2 as hash function for administrator accounts in FortiOS v7.2.11 and later" — community.fortinet.com
- Fortinet, "FG-IR-26-060" (CVE-2026-24858) — fortiguard.com / "FG-IR-25-647" (CVE-2025-59718, CVE-2025-59719) — fortiguard.com
- CISA, "CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure" (June 18, 2026, revised June 22) — cisa.gov
- JPCERT/CC, alert on leaked credentials related to Fortinet products (JPCERT-AT-2026-0019, June 23, 2026, in Japanese) — jpcert.or.jp
- Singapore CSA, "Advisory on Credential Compromise of FortiGate Devices ("FortiBleed")" (AD-2026-007, June 22, 2026) — csa.gov.sg
- FBI and U.S. Secret Service, "FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts" (JCSA-20261006-01, October 6, 2026) — ic3.gov
Change log
2026-10-26: First version, based on publications from Fortinet, CISA, JPCERT/CC, Singapore's CSA, the FBI and the U.S. Secret Service.
Read next
- Defending exposed devices: How to defend VPN devices and remote access
- Edge device flaws exploited around the same time: Exploited edge device vulnerabilities, mid-October 2026
- Trends: Breaches in 2026 run on valid credentials more than vulnerabilities
- MFA: Choosing MFA the right way
- Terms: What is password hashing? / What is ransomware