CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

The FortiBleed campaign exposed a systemic failure in basic credential hygiene and device hardening, with threat actors exploiting default credentials, previously breached accounts, and brute-force attacks across tens of thousands of internet-facing FortiGate devices. Organizations in critical sectors — telecom, government, and education — failed to enforce strong authentication controls and rotate credentials after known breaches, leaving devices persistently vulnerable. This matters because network security appliances like firewalls are high-value targets; compromising them grants attackers a privileged vantage point over an entire organization's traffic. The scale of exposure (86,000+ devices) demonstrates that many organizations lack continuous visibility into the configuration and credential posture of their perimeter devices.