(TLP:CLEAR) Widespread “FortiBleed” Credential Exposure Campaign Affects Fortinet Firewalls and VPN Gateways (Updated June 25, 2026)

ACTION MAY BE REQUIRED for utilities using Fortinet FortiGate firewalls, SSL VPN, or VPN gateway services. Utilities that outsource technology support may need to consult their service providers for assistance with investigation and remediation actions.

June 25, 2026

Following WaterISAC’s original report of the FortiBleed activity (see below), CISA released an alert on June 18 and updated it on June 22. CISA indicates it is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials.

WaterISAC encourages impacted members to incorporate CISA’s mitigation guidance, which includes:

1. Terminate sessions and reset credentials. Terminate all active SSL VPN and administrative sessions. Reset all Fortinet VPN and administrative passwords, especially on internet-facing systems, and enforce strong password policies.
2. Ensure secure credential storage. Confirm your organization’s use of the Password-Based Key Derivation Function 2 (PBKDF2) algorithm to store administrator credentials and remove weaker legacy hashes per Fortinet’s guidance (see, Fortinet’s Technical Tip: Enforcing PBKDF2 as hash function for administrator accounts in FortiOS v7.2.11 and later).  
3. Review logs. Review firewall, VPN, authentication, and domain controller logs for lateral movement, unusual access, suspicious accounts, or unauthorized configuration changes.
4. Enable phishing-resistant multifactor authentication (MFA). Require phishing-resistant MFA on all remote access and administrative accounts and ensure it is enforced on all external gateways and administrative interfaces.
5. Reduce the attack surface and lock down management access. Ensure the administration of your firewall is inaccessible from the public internet, restrict Fortinet management interfaces to trusted internal networks, and remove or disable any unauthorized or unnecessary accounts.

June 18, 2026

Summary: Recent public reporting and government alerts describe a widespread malicious campaign, dubbed “FortiBleed,” involving exposed credentials affecting Fortinet firewalls and VPN gateways. The exposed data includes Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords, associated with tens of thousands of Fortinet firewall URLs worldwide.

The campaign is particularly concerning for utilities because Fortinet firewalls and VPN gateways may provide remote access into enterprise environments, third-party support networks, and systems used by operational personnel. If valid credentials are leveraged, threat actors could gain remote access to affected devices and connected networks, modify device settings, alter security controls, or use perimeter access to pivot further into internal environments.

Analyst Note: WaterISAC strongly encourages members using Fortinet firewall or VPN services to immediately review their exposure, rotate all Fortinet VPN and administrative credentials, terminate active SSL VPN and administrative sessions, enforce MFA across all external gateways and administrative interfaces, restrict management interfaces to trusted networks only, and ensure Fortinet devices are running the latest firmware.

Members can also examine authentication and access logs for abnormal logins, unauthorized changes, suspicious accounts, or backdoor users. The Canadian Centre for Cyber Security specifically recommends inventorying Fortinet device accounts and disabling or removing unauthorized or suspicious accounts, including accounts such as forticloud-sync or forticloud-tech if they are not expected in the environment.

Recommended Actions:

• Rotate all Fortinet VPN and administrative credentials immediately.
• Terminate active SSL VPN and administrative sessions.
• Enforce MFA for all external gateways and admin interfaces.
• Restrict Fortinet management interfaces to trusted networks and hosts only.
• Ensure Fortinet devices are fully patched and running supported firmware.
• Confirm credentials are stored using PBKDF2 hashing after devices are updated.
• Review authentication, access, and configuration logs for suspicious activity.
• Investigate unauthorized accounts, configuration changes, or signs of persistence.

Original Source: https://www.cyber.gc.ca/en/alerts-advisories/al26-014-fortibleed-leak-thousands-compromised-credentials-impacting-fortinet-devices

Additional Reading:

• Reported widespread credential exposure affecting Fortinet Firewalls and VPN Gateways
• FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices.

Related WaterISAC PIRs: 6, 8, 10