FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices

The FortiBleed campaign exploits a dangerous combination of internet-exposed FortiGate management interfaces, reused or weakly hashed credentials, and unpatched known CVEs—none of which require a novel exploit to abuse. Attackers leveraged credential reuse, brute-force, and password-spraying techniques to compromise devices that should never have been directly reachable from the internet. The absence of multi-factor authentication on VPN and management gateways dramatically lowered the bar for attackers. This incident underscores that hygiene failures—not sophisticated zero-days—remain the primary enabler of large-scale network appliance compromises. Organizations that left previously disclosed Fortinet vulnerabilities unpatched face compounded risk as stolen credentials from earlier breaches fuel ongoing access.