FortiBleed: Six Checks That Tell You Whether Your FortiGate Is One of the 86,000.

01 Six checks, in the order to run them

Run them in this order. The first two tell you whether to keep going as hygiene or switch to incident response.

Check 6 catches the most well-run teams. Fortinet introduced PBKDF2 hashing for admin passwords in 7.2.11, 7.4.8 and 7.6.1, but an upgraded device keeps each administrator’s old SHA-256 hash until that person logs in again. A hidden “old-password” setting can also keep the old hash in a super_admin configuration backup. On 7.2 and 7.4, Arctic Wolf recommends enabling login-lockout-upon-weaker-encryption in the password policy to purge them [ Arctic Wolf ] . Treat every configuration backup as a password file, because for an attacker with a cracking rig, it is one.

One related item sits outside FortiBleed proper. The CSA advises disabling FortiCloud SSO on any device not yet patched for CVE-2026-24858, a separate FortiCloud flaw that CISA added to its Known Exploited Vulnerabilities catalogue on 27 January 2026 [ CSA ] .

02 Why attackers log in instead of exploiting

An exploit is loud. It sends unusual traffic, it sometimes crashes the device, and the vendor eventually patches it. A valid login does none of that. It looks exactly like your own engineer, it survives every firmware update, and the attacker can reuse it next month.

The economics in this campaign were simple. Hudson Rock estimated about 1.16 billion credential attempts against more than 320,000 FortiGate targets [ Infosecurity ] . Most failed. SOCRadar still ended up with confirmed working admin logins for 30,791 devices, sorted by country, sector and the victim’s revenue [ Arctic Wolf ] . That sorting tells you the buyer. The attackers created their own accounts on the firewalls, then sold the access or used it themselves, and the FBI and Secret Service say brokers offered it to affiliates of the INC, Lynx and Payload ransomware operations [ The Record ] .

The default names did a lot of the work. The CSA counted about 63% of compromised accounts as default system accounts or generic admin accounts nobody had renamed [ CSA ] . If the attacker can guess the username, the password is the only thing left to guess, and lists of leaked passwords are cheap. We put a price on what happens next in a working login to your network sells for $700.

In our own external tests, an edge device that accepts a password alone from the internet is one of the findings we raise most often. Usually the team knows MFA is on for staff VPN and has forgotten the admin page was never in scope for it.

03 If your device is one of them

A bad result on checks 1 to 4 means you are past password hygiene. The UK NCSC’s guidance is the clearest public sequence, and it matches what Fortinet tells affected customers [ NCSC ] [ Fortinet PSIRT ] :

1. Isolate the device from the internet and from your internal network.
2. Preserve logs, configuration and other artefacts first. You will need them to scope what the attacker reached.
3. Factory reset. Changing credentials alone can leave the attacker’s accounts and tunnels in place.
4. If the FortiGate is bound to Active Directory or LDAP, treat that service account as compromised and hunt for it elsewhere.
5. Check every other edge device that shared the same admin credentials, and watch firewall logs for onward movement into the devices this one could reach.
6. Rebuild on current firmware, with the management interface off the internet, unique admin passwords, multi-factor authentication on VPN and admin logins, and PBKDF2 in use.

US organisations can report to the FBI through IC3, the route the 6 October advisory came from. UK organisations report through the NCSC.

FortiBleed will not be the last campaign built on logins rather than bugs. Attackers keep coming back to them because they work. Would your edge devices pass all six checks today, or would the first one you look at fail? We run them from the outside across every firewall, VPN and admin page you expose, and hand you the devices that open. Start with a free audit.