[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzclRW7cddJbi1CjXLVoWVNa0oT6mP-5b_WlISUFzATw":3},{"article":4,"iocs":56,"watch_terms":57,"solutions":58,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":34,"category":35,"article_tags":38},"4e2bab21-fe32-4acb-8e8e-730181bcbcc0","CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure","cisa-urges-hardening-fortinet-devices-after-reports-of-credential-exposure-ca68a8","CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials. This activity, referred to as FortiBleed, involves the exposure of leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network (VPN) gateways. To defend against this malicious cyber activity, CISA urges impacted Fortinet customers with FortiGate appliances and associated secure sockets layer (SSL) VPN gateways to immediately: Terminate sessions and reset credentials. Terminate all active SSL VPN and administrative sessions. Reset all Fortinet VPN and administrative passwords, especially on internet-facing systems, and enforce strong password policies. Ensure secure credential storage. Confirm your organization’s use of the Password-Based Key Derivation Function 2 (PBKDF2) algorithm to store administrator credentials and remove weaker legacy hashes per Fortinet’s guidance (see, Fortinet's Technical Tip: Enforcing PBKDF2 as hash function for administrator accounts in FortiOS v7.2.11 and later). Review logs. Review firewall, VPN, authentication, and domain controller logs for lateral movement, unusual access, suspicious accounts, or unauthorized configuration changes. Enable phishing-resistant multifactor authentication (MFA). Require phishing-resistant MFA on all remote access and administrative accounts and ensure it is enforced on all external gateways and administrative interfaces. Reduce the attack surface and lock down management access. Ensure the administration of your firewall is inaccessible from the public internet; restrict Fortinet management interfaces to trusted internal networks; and remove or disable any unauthorized or unnecessary accounts. See the following resources to determine your organization’s potential impact and find additional guidance on the credentials compromised: Tech Times: Fortinet FortiGate Credential Leak Hits 73,932 Firewalls: Half the Internet-Facing Fleet SOCRadar: FortiBleed: The Compromise of 80,000+ Fortinet Firewalls Hudson Rock: FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed – Claim Your Ethical Disclosure Arctic Wolf: Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries Fortinet: Attacks at the Speed of AI Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA.","CISA has issued a warning regarding the 'FortiBleed' activity, where cyber actors are exploiting compromised credentials to target internet-accessible Fortinet devices. Approximately 74,000 Fortinet firewalls and VPN gateways have been affected by this credential exposure. CISA is urging customers to immediately terminate sessions, reset all VPN and administrative passwords, ensure secure credential storage using PBKDF2, review logs for suspicious activity, enable phishing-resistant MFA, and reduce the attack surface by locking down management access.","CISA warns of Fortinet device credential exposure impacting 74,000 devices globally.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F06\u002F18\u002Fcisa-urges-hardening-fortinet-devices-after-reports-credential-exposure",null,"2026-06-18T12:00:00+00:00","2026-06-18T22:00:21.997347+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"Fortinet","vendor",{"name":21,"type":22},"FortiGate","product",{"name":24,"type":22},"SSL VPN",{"name":26,"type":27},"PBKDF2","technology",{"name":29,"type":30},"malicious cyber actors","threat_actor",{"name":32,"type":33},"FortiBleed","campaign","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":34,"icon":12,"name":36,"slug":37},"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":12,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":12,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":12,"name":52,"slug":53},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":55},{"id":34,"icon":12,"name":36,"slug":37},[],[18,21,24],{"controls":59,"vendors":146},[60,89,117],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":90,"name":91,"problem":92,"products":93},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":90,"product_name":114,"url":115,"description":116},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":118,"name":119,"problem":120,"products":121},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",[147],{"slug":148,"name":18,"logo_path":149,"roles":150},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[151],"affected",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":171},"fortibleed-74000-fortinet-devices-exposed-via-credential-compromise","FortiBleed: 74,000 Fortinet Devices Exposed via Credential Compromise","The 'FortiBleed' campaign highlights the critical danger of exposed credentials on internet-facing network appliances such as firewalls and VPN gateways. Threat actors leveraged compromised credentials — likely obtained through prior vulnerabilities or weak credential storage — to gain unauthorized access to approximately 74,000 Fortinet devices. This matters because perimeter devices like firewalls and VPNs are the gatekeepers of enterprise networks; once compromised, attackers gain a privileged foothold that can bypass many internal security controls. Organizations that fail to rotate credentials, enforce MFA, or restrict management access to trusted networks dramatically increase their exposure to this class of attack.",[157,158,159,160,161,162,163,164,165,166,167,168,169,170],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF PR.AC-1: Identities and Credentials Management","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (for EU-scoped organizations)","ITIL Change Management: Emergency Change Procedures",{}]