[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZJzHPJoyyMOzZJcs8rKvLp8vU2fBJkZIWq_okBGYyd0":3},{"article":4,"iocs":56,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"295dc96f-c5f4-42a1-b837-b4283ce65b79","CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices","cisa-warns-fortinet-customers-as-fortibleed-hits-86-644-fortigate-devices-16da98","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday urged Fortinet customers with FortiGate appliances to take steps to secure against ongoing malicious activity aimed at thousands of internet-accessible devices. The sweeping campaign, believed to be the work of Russian-speaking threat actors, has been codenamed FortiBleed. The number of compromised devices stands at","CISA has issued a warning to Fortinet customers regarding the FortiBleed campaign, which has compromised over 86,000 FortiGate devices. The campaign, attributed to Russian-speaking threat actors, leverages a combination of default credentials, previously breached accounts, and brute-force attacks to gain access. Impacted sectors include telecom, government, and education, with a significant number of exposures in India, the U.S., Mexico, Colombia, and Thailand.","CISA warns Fortinet customers of FortiBleed campaign compromising 86,644 FortiGate devices.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fcisa-warns-fortinet-customers-as.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEg0NmhjowFYAIQws_hl2u1bMpkeyma6TUk8UumS90AdqbBjW_NJ5h97i1yV9uJ_GT6zT8A9jaruiGkhqvn0jb4LuaHDDbGtjZbB7tQQibuQmH4WTDeAI898xZnyDuUQOAvzPHooO7C2S2PQFPIvkmwZ8LTLO4xLUP5ygQVuZI3E0quggcAEvtOqKzx4zKdw\u002Fs1600\u002Fcisa-fortinet.jpg","2026-06-19T14:00:21+00:00","2026-06-19T16:00:18.238506+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Fortinet","vendor",{"name":21,"type":22},"FortiGate","product",{"name":24,"type":25},"Russian-speaking threat actors","threat_actor",{"name":27,"type":22},"SSL VPN",{"name":29,"type":22},"VPN gateways",{"name":31,"type":32},"SHA-256","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57],{"type":53,"value":58,"context":59},"FortiBleed","Name of the campaign targeting Fortinet devices",[18,21,27],{"controls":62,"vendors":147},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":93,"name":94,"problem":95,"products":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":122,"name":123,"problem":124,"products":125},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[126,134,139],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":135,"product_name":136,"url":137,"description":138},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[148],{"slug":149,"name":18,"logo_path":150,"roles":151},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[152],"affected",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":170},"fortibleed-86000-fortigate-devices-compromised-via-default-credentials-and-brute-force","FortiBleed: 86,000+ FortiGate Devices Compromised via Default Credentials and Brute Force","The FortiBleed campaign exposed a systemic failure in basic credential hygiene and device hardening, with threat actors exploiting default credentials, previously breached accounts, and brute-force attacks across tens of thousands of internet-facing FortiGate devices. Organizations in critical sectors — telecom, government, and education — failed to enforce strong authentication controls and rotate credentials after known breaches, leaving devices persistently vulnerable. This matters because network security appliances like firewalls are high-value targets; compromising them grants attackers a privileged vantage point over an entire organization's traffic. The scale of exposure (86,000+ devices) demonstrates that many organizations lack continuous visibility into the configuration and credential posture of their perimeter devices.",[158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 12: Network Infrastructure Management","CIS Control 17: Incident Response Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF ID.AM-1: Asset Inventory","NIST CSF PR.AC-1: Credential Management","ITIL Change Management: Emergency patching procedures for critical vulnerabilities","GDPR Article 32: Security of Processing (for EU-affected organizations)",{}]