BreachPublished 19 Jun 2026

CISA warns Fortinet users to secure devices after FortiBleed leak

Source Bleeping Computer

Description

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged Fortinet customers to secure their devices after nearly 74,000 firewall and VPN credentials were exposed in a data leak dubbed "FortiBleed." [...]

Impact

Exposure of nearly 74,000 Fortinet firewall and VPN credentials, including plaintext passwords, enables threat actors to access and potentially compromise affected devices. This impacts a broad range of organizations worldwide, including major corporations and government agencies, increasing the risk of unauthorized access, data breaches, and lateral movement within networks. The leak undermines the confidentiality and integrity of affected Fortinet devices and associated networks. The source of the leak is unknown, so further vulnerabilities or attack vectors may exist. The widespread nature of the leak and the presence of active devices online heighten the risk of exploitation.

Defensive guidance

CISA recommends that affected Fortinet device owners immediately terminate all SSL VPN and administrative sessions, reset all VPN and administrative passwords, and enable phishing-resistant multifactor authentication. Additionally, organizations should review logs for unauthorized access or lateral movement, restrict firewall management interfaces from public internet access, remove unauthorized accounts, and store admin credentials using the PBKDF2 hashing algorithm. These steps reduce the attack surface and help mitigate risks associated with the leaked credentials.

References

bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Jun 2026, 06:50 UTC

References

Community reviews