FortiBleed Campaign: Credentials Exposed for +80,000 Fortinet Appliances

THE THREAT

In June 2026, an ongoing campaign targeting Fortinet firewalls and VPN appliances was discovered, dubbed FortiBleed. The campaign was discovered through the identification of an exposed open directory, containing valid Fortinet VPN credentials for tens of thousands of organizations around the globe. Usage of the exposed credentials could grant threat actors unauthorized access to impacted devices, where they can change settings, modify security controls, and create backdoor users.

Organizations utilizing Fortinet VPN and firewall appliances should rotate administrator credentials as soon as possible, and ensure that access to the Fortinet Management Interface is restricted to trusted IP addresses only.

What we’re doing about it

• eSentire’s Threat Response Unit (TRU) is performing threat hunts to identify potential signs of compromise
• eSentire MDR for Network has detections in place to identify exploitation of vulnerabilities impacting Fortinet appliances, specifically for CVE-2024-55591 and CVE-2025-59718
• eSentire MDR for Log has detections in place monitoring for suspicious Fortinet-related login activity
• eSentire’s Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2024-55591, CVE-2025-59718, and CVE-2025-59719
• eSentire’s TRU team is actively tracking this topic for additional information and detection opportunities

What you should do about it

• Organizations utilizing Fortinet VPN and firewall appliance should evaluate exposure using publicly available tools
• Credentials for administrator accounts should be rotated immediately, and login activity should be audited for unknown access
  • Multi-Factor Authentication (MFA) should be enforced on all accounts where possible
• Audit all accounts on Fortinet devices, looking for any unauthorized or suspicious accounts
• Restrict access to Fortinet Management Interfaces to trusted networks and IP addresses
• Ensure that Fortinet devices are running the latest firmware
  • CCCS specifically notes that organizations should ensure that patches for CVE-2024-55591 (privilege escalation), CVE-2025-59718, and CVE-2025-59719 (authentication bypass) are applied

Additional information

The campaign was first identified by security researcher Voldymyr Diachenko, and later verified by the researcher Kevin Beaumont. The identified data contains email addresses, usernames, and passwords, and appears to have originated from exports of configuration files taken directly from Fortinet appliances. The specific method for how the configuration files were obtained is not currently known but is suspected to be linked to data stolen from previous exploitation of vulnerabilities impacting the devices. Organizations that responded to previous incidents impacting Fortinet appliances with applying patches, but not rotating credentials, remain at risk. Kevin Beaumont notes that the data set appears to be recent, and contains information on the impacted company, such as industry, revenue, and country. The formatting of the information is notable, as it has commonly been linked with cybercrime operations, and FortiBleed has been assessed as a possible initial access operation, selling access to exposed appliances to other attackers.

No specific attribution has been made to the operators behind the FortiBleed campaign, but they have been assessed as possibly Russian speaking, based on the tooling, infrastructure, and victim selection identified. Further review into the exposed infrastructure found that the database contains credentials for over 86,000 devices belonging to companies and government organizations across 194 countries. The list of impacted organizations spans “every sector of the global economy”, including banks, telecommunications, hospitals, higher education, and critical infrastructure, and impacting countries in Asia, Europe, the Americas, the Middle East, and Africa. Investigation into the data found that nearly one-third of entries originated from organizations the United States and India.

References:

[1] https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/
[2] https://www.hudsonrock.com/fortinet
[3] https://socradar.io/free-tools/fortibleed
[4] https://www.cyber.gc.ca/en/alerts-advisories/al26-014-fortibleed-leak-thousands-compromised-credentials-impacting-fortinet-devices
[5] https://nvd.nist.gov/vuln/detail/cve-2024-55591
[6] https://www.esentire.com/security-advisories/previously-patched-fortinet-vulnerability-cve-2025-59718-exploited-in-the-wild
[7] https://www.esentire.com/security-advisories/fortinet-vulnerability-exploited-in-the-wild-cve-2025-59718
[8] https://www.linkedin.com/feed/update/urn:li:activity:7471222472193830913/
[9] https://medium.com/doublepulsar/fortibleed-75k-fortinet-firewalls-have-admin-passwords-cracked-60299faa65f8