[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxgBtsr1jTmZBIishFSXxhMPjlfYMreBj-ni_Pd4tKmY":3},{"article":4,"iocs":51,"watch_terms":60,"solutions":61,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"8619fdfc-2e82-4fcb-8875-c91ae004229a","FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices","fortibleed-credential-reuse-legacy-hashes-and-the-risk-of-internet-exposed-forti-bff859","Key Takeaways FortiBleed refers to June 2026 public reporting of large-scale credential exposure and abuse targeting internet-reachable FortiGate management and SSL-VPN gateways driven by credential reuse and brute-force, not a single new zero-day. Risk is highest for internet-exposed FortiGate devices without MFA, with reused or legacy-hashed credentials, or prior exposure to known-exploited Fortinet CVEs. A […]","FortiBleed is a June 2026 credential exposure and abuse campaign targeting internet-reachable FortiGate management and SSL-VPN gateways through credential reuse, brute-force, and password-spraying—not a new zero-day vulnerability. Risk is highest for exposed devices lacking MFA, using reused or legacy-hashed credentials, or previously vulnerable to known Fortinet CVEs. Qualys maps eight relevant Fortinet CVEs with detection queries and provides threat-hunting guidance to identify and remediate exposed assets.","FortiBleed: Large-scale credential reuse and brute-force attacks target internet-exposed FortiGate devices","https:\u002F\u002Fblog.qualys.com\u002Fvulnerabilities-threat-research\u002F2026\u002F07\u002F08\u002Ffortibleed-fortigate-credential-reuse-internet-exposed","https:\u002F\u002Fik.imagekit.io\u002Fqualys\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002FBlog-Images-1080x1080.FortiBleed-1-1.png","2026-07-08T17:38:12+00:00","2026-07-08T18:00:10.901786+00:00",9,[17,20,22,25,27],{"name":18,"type":19},"FortiGate","product",{"name":21,"type":19},"FortiOS",{"name":23,"type":24},"Fortinet","vendor",{"name":26,"type":24},"Qualys",{"name":28,"type":29},"FortiBleed","campaign","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":30,"icon":32,"name":33,"slug":34},null,"Identity & Access","identity-access",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,58],{"type":53,"value":54,"context":55},"cve","CVE-2026-24858","Fortinet vulnerability mapped to FortiBleed exploitation",{"type":53,"value":57,"context":55},"CVE-2025-59718",{"type":53,"value":59,"context":55},"CVE-2025-59719",[23,26,18],{"controls":62,"vendors":149},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":93,"name":94,"problem":95,"products":96},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[97,104,112],{"vendor_slug":98,"vendor_name":26,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":121,"name":122,"problem":123,"products":124},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",[150,155],{"slug":151,"name":23,"logo_path":152,"roles":153},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[154],"affected",{"slug":98,"name":26,"logo_path":99,"roles":156},[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":178},"fortibleed-exposed-fortigate-devices-fall-to-credential-abuse-not-zero-days","FortiBleed: Exposed FortiGate Devices Fall to Credential Abuse, Not Zero-Days","The FortiBleed campaign exploits a dangerous combination of internet-exposed FortiGate management interfaces, reused or weakly hashed credentials, and unpatched known CVEs—none of which require a novel exploit to abuse. Attackers leveraged credential reuse, brute-force, and password-spraying techniques to compromise devices that should never have been directly reachable from the internet. The absence of multi-factor authentication on VPN and management gateways dramatically lowered the bar for attackers. This incident underscores that hygiene failures—not sophisticated zero-days—remain the primary enabler of large-scale network appliance compromises. Organizations that left previously disclosed Fortinet vulnerabilities unpatched face compounded risk as stolen credentials from earlier breaches fuel ongoing access.",[163,164,165,166,167,168,169,170,171,172,173,174,175,176,177],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST CSF ID.AM-1: Asset Inventory","NIST CSF PR.AC-3: Remote Access Management","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities","ISO\u002FIEC 27001:2022 A.8.20: Network Security",{}]