FortiBleed is not a new Fortinet bug. It is a credential campaign that is still locking administrators out of their own firewalls. Help Net Security flagged the joint FBI and U.S. Secret Service warning again on 11 October 2026. SOCRadar has verified more than 86,644 compromised devices in 194 countries.
What happened
Criminals reuse credentials from earlier Fortinet incidents and from infostealer logs, then stuff and spray them against internet-facing FortiGate firewalls and SSL VPN gateways. On a foothold they pull password hashes and crack legacy hashes offline on GPU clusters.
During the intrusion they create new local accounts. In some cases they delete or change the original admin passwords so the owner cannot get back in, while they try to move laterally. Access brokers have sold that foothold on to ransomware affiliates. Fortinet has said this is not a new vulnerability, and that the activity tracks back to weak passwords, missing MFA, and credentials from earlier incidents.
Who is affected
- Anyone running an internet-facing FortiGate or Fortinet SSL VPN, especially if admin or VPN passwords were ever reused or stored under older hashing.
- South African sites that leave firewall management or SSL VPN on a public address with local accounts and no phishing-resistant MFA.
- Teams that reset a password and assumed that cleared the attacker. Live sessions survive a reset.
What to do now
Terminate every admin and VPN session, reset those passwords, and turn on phishing-resistant MFA before you call the box clean. Pull management off the internet. Look for accounts you did not create, including names that look like vendor support. Compare the config to a known-good backup. If you are already locked out, plan a rebuild rather than a password guess.
Source: Help Net Security week in review, 11 October 2026, citing the FBI and U.S. Secret Service advisory and SOCRadar's device count. Read the report.
Also on the blog
- CyberXero used Claude Code to steal 628,000 Ukrainian records
- Edward Dubrovsky arrested in Pennsylvania extortion case
- Nippon Columbia malware exposed 8.63 million karaoke records
- Fake Claude ads hide a ClickFix command behind Bing
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.