FortiBleed: Massive Fortinet Firewall Credential Leak and How to Respond

by

What is FortiBleed?

In June 2026, JPCERT/CC published an advisory (JPCERT‑AT‑2026‑0019) describing a large‑scale credential leak affecting Fortinet FortiGate devices. The leak, dubbed FortiBleed, does not stem from a new vulnerability; instead, attackers are re‑using authentication data obtained from previous incidents.

Scope of the compromise

Security vendor SOCRadar reported that its database contains login information for more than 86,644 FortiGate firewalls spanning 194 countries, covering both corporate and government networks.

Why the leaked credentials remain dangerous

Although the data were originally harvested in older breaches, researchers have noted that many of the credentials are still valid. In addition, FortiGate configuration files store administrator password hashes; if an attacker obtains a config dump, they can perform offline cracking to recover clear‑text passwords.

Potential impact

  • Unauthorised VPN access leading to internal network infiltration.
  • Possibility of intercepting authentication traffic (Kerberos, NTLM) and extracting Active Directory credentials.
  • Compromise of downstream services even after the FortiGate device is isolated.

How to check if your organisation is affected

  1. Review config export logs: In the FortiGate GUI, filter System → Events → Messages by “Config” and look for export events for both admin and REST‑API accounts.
  2. Investigate suspicious admin logins: Correlate login attempts with the IP addresses listed in the SOCRadar “IoCs” document.
  3. Use public lookup tools: Hudson Rock and SOCRadar provide free services to query whether your domain appears in the leaked dataset.
  4. Audit configuration and logs: Search for unexpected accounts such as forticloud, fortiuser, or fortinet‑support, and compare current configs with a known‑good baseline.

Recommended mitigations

JPCERT/CC advises organisations that suspect exposure to take the following steps:

  • Rotate all compromised credentials immediately and enforce multi‑factor authentication (MFA) for admin and API accounts.
  • Update FortiOS to a version that uses PBKDF2 for password hashing (v7.2.11 or later). Note that older SHA‑256 hashes may remain in old‑password fields, so a full password reset is required.
  • Follow Fortinet’s Technical Tip: Recommended steps to execute in case of a compromised host.
  • Monitor Active Directory for anomalous authentication activity, as attackers may leverage stolen VPN credentials to harvest domain credentials.

Vendor perspective

Fortinet’s PSIRT states that the incident is not linked to a new vulnerability but rather to the reuse of previously stolen data (vendor claim). Nonetheless, the advisory stresses that the leaked credentials may still be valid and should be treated as an active threat.

Conclusion

The FortiBleed incident highlights the long‑term risk of credential reuse and the importance of robust password hashing, MFA, and continuous monitoring. Organisations running FortiGate firewalls should verify exposure, rotate credentials, and upgrade to PBKDF2‑enabled firmware without delay.