↓Skip to main content
  1. News/

FortiBleed: What to Ask Your IT Person This Week

·6 mins
FortiBleed Fortinet Firewall Ransomware Small Business
Table of Contents
On October 6, 2026, the FBI and U.S. Secret Service published a joint advisory about FortiBleed, an active campaign against Fortinet FortiGate firewalls. It cites reports of lockouts, where owners are shut out of their own devices. You do not need to understand the technology. You do need to ask your IT person five questions this week, and this post gives them to you.

What FortiBleed is, and what it is not #

FortiBleed is not a new software bug, and neither the agencies nor Fortinet name a CVE (the public ID number for a specific flaw) for it. The FBI and Secret Service call it “an active, global credential-compromise campaign” aimed at internet-facing FortiGate firewalls and their VPN gateways. A VPN is the remote-access door staff use to reach the office network from home.

Fortinet’s own security team says plainly: “This is not a new Fortinet vulnerability.” It describes attackers reusing passwords from earlier incidents against devices with weak password habits and no multi-factor authentication (MFA, the second proof of identity after a password). It also says the problem “is not unique to Fortinet.”

How the attack works #

The advisory draws on files the operators left on an exposed server. In plain terms, the steps look like this:

  • They scan the internet for firewall login pages.
  • They try passwords leaked elsewhere (credential stuffing) and a few common passwords across many accounts (password spraying).
  • They copy stored password hashes, which are scrambled versions of passwords, and crack them offline on rented graphics-card hardware.
  • They create new administrator accounts on the firewall so they can get back in.
  • They sell the access. The advisory calls the operators an “initial-access broker,” meaning a seller of break-in access.

Reporting cited by the agencies says buyers include ransomware groups, currently INC/Lynx and Payload. The advisory also describes scripts that rank targets by revenue and network structure. That is the advisory’s wording, and it is a fair reason a mid-size business is worth a look.

On scale: the advisory says SOCRadar, a security firm, verified more than 86,644 compromised devices across 194 countries. BleepingComputer reports SOCRadar’s separate figure of more than 430,000 firewalls targeted, which is not the same as compromised.

The five questions #

Who is exposed? Anyone running a FortiGate with the admin page or VPN reachable from the internet and no MFA. You may not know whether that is you. Ask your IT person or MSP what firewall you own.

1. Is our firewall’s admin page reachable from the internet? The advisory ranks the fixes: limit management to trusted addresses (good), use a local-in policy (better), or remove internet administration altogether (best).

2. Is MFA turned on for every admin and VPN login? The advisory asks for phishing-resistant MFA on all remote access and administrative accounts. The advisory doesn’t define the term, so ask your IT person what kind your firewall uses.

3. Have all admin and VPN passwords been reset, and active sessions ended? The advisory tells defenders to terminate all active administrative sessions and reset all VPN and administrative passwords, especially on internet-facing systems. Fortinet gives the same advice.

4. Are there admin accounts on the firewall that nobody can explain? The advisory says to pay particular attention to unrecognized accounts. It also says to review REST API keys, which are access tokens for software, and to treat unknown ones as a significant risk.

5. Is the firmware current, and have admins logged in again since the upgrade? The upgrade adds safer password storage, but SOCRadar says an older password stays in its old format until that administrator logs in again. Fortinet’s own technical tip says the same and recommends every admin log in once on the updated firmware. We are not naming version numbers because the sources differ. Ask your IT person to follow Fortinet’s current upgrade guidance.

If you are locked out or suspect a break-in #

Call your IT person or MSP first. They can contact Fortinet support, which is who Fortinet’s post names. Fortinet says that if you believe your internal network may be compromised, you should contact its support, and that unapproved changes mean treating the device as compromised.

Ask them to collect logs and configuration files before anyone factory-resets the firewall. Singapore’s Cyber Security Agency notes a reset destroys that evidence.

Then report it. The FBI and Secret Service urge reports to the Internet Crime Complaint Center (IC3), your local FBI field office, or your local Secret Service field office, whether or not a ransom is paid. They do not encourage paying a ransom, because paying does not ensure files come back and may embolden attackers. Useful details include date and time, type of activity, number of people affected and a point of contact.

What to expect from the vendor #

Less than you might hope. Fortinet says it has identified potentially compromised systems, is contacting affected customers “in the days to come,” and “strongly encourage[s]” all customers to complete its remediation steps. We found no public statement of a vendor cleanup service or support commitment. The work lands on your IT provider.

The campaign is months old. Fortinet’s post is dated June 19, 2026. The urgency now comes from the agencies’ October advisory and the lockout reports, not from a new flaw.

The agencies also advise vetting indicators, such as addresses and account names, before blocking them. We have not copied any here. Your IT person can take them from the advisory.

What to do this week #

Forward this post to your IT person or MSP and ask for written answers to all five questions. If any answer is “we’re not sure,” that is useful to know.

At SOC-Lite, a named analyst reviews your alerts, calls you when one is real, works with your IT person or MSP on the fix, and keeps the evidence. A visibility check is free, it takes 20 minutes, and you talk to us by phone or at your office. Book a visibility check

Updates #

2026-10-17: First published, based on the sources below as of this date.

Sources #