2026-10-26
FortiBleed (FortiGate credential leak, about 74,000 devices): not a new vulnerability, so admin and VPN passwords must be changed
FortiBleed is the large-scale leak and misuse of administrator and SSL VPN credentials for FortiGate, Fortinet's firewall and VPN appliance. On June 18, 2026, CISA warned that credentials associated with about 74,000 devices had leaked. On June 19, Fortinet said it is not a new vulnerability and that the activity likely involves reuse of credentials from previous incidents plus brute-forcing of devices with weak passwords and no multi-factor authentication. On June 23, JPCERT/CC issued an alert saying it had confirmed that the data includes information related to Japanese companies. On October 6, the FBI and the U.S. Secret Service warned that the activity continues, that some administrators have been locked out of their devices, and that the access has been used as an entry point for ransomware. Upgrading to fixed firmware does not invalidate leaked passwords. This site's conclusion: if you run FortiGate, change admin and VPN passwords, enforce multi-factor authentication, take the management interface off the internet, and remove the legacy SHA-256 copies of admin passwords.