FortiBleed: why patching isn’t enough for your Fortinet firewall
On October 6, 2026, the FBI and the U.S. Secret Service published a joint advisory on FortiBleed, a credential-theft campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The message is clear: the campaign, uncovered this summer, is still active. If your SMB has a Fortinet firewall at the office or for remote work, this is for you.
According to the advisory, attackers reuse stolen or previously leaked credentials, create new administrator accounts on the firewall, then move deeper into the victim’s network. In some cases, they disable or delete the original accounts, or change passwords, to lock the owner out. The agencies warn that recovery then takes more than standard patching and a password reset. Initial access brokers sell this access to ransomware affiliates, including INC/Lynx and Payload.
The essentials in 3 points
- This is not a new vulnerability, Fortinet says: attackers reuse credentials from past incidents and brute-force weak passwords on devices without multi-factor authentication (MFA).
- SOCRadar, cited in the advisory, verified more than 86,644 compromised devices across 194 countries. The campaign is global, even though the advisory is American.
- An update helps, but it does not evict an attacker who is already in: their accounts, keys and stolen passwords stay valid.
What the patch fixes, and what it doesn’t
The usual reflex (“we’ll update and we’re done”) isn’t enough here. Here is, row by row, what an update to your Fortinet firewall actually changes, and what is left to do.
| Issue | What the patch fixes | What it doesn’t fix (your job) |
|---|---|---|
| Admin password storage | The latest FortiOS 7.4, 7.6 and 8.0 versions support stronger hashing (PBKDF2) instead of legacy SHA-256. | Weak legacy hashes remain until you follow Fortinet’s guidance to remove them. And a password that was already cracked is still a known password. |
| Stolen VPN and admin passwords | Nothing. | Terminate all active admin and VPN sessions, then reset all VPN and administrator passwords. |
| Admin accounts added by the attacker | Nothing: they survive the update. | Review every administrator and VPN account and confirm it is legitimate. |
| Unknown (REST) API keys | Nothing. | Remove unknown keys and refresh legitimate ones, as the advisory recommends. |
| Admin interface open to the internet | Nothing: it’s a configuration choice. | Restrict access: trusted hosts (good), a local-in policy (better) or no internet administration at all (best). |
| VPN protected by a password only | Nothing. | Require phishing-resistant MFA on all remote access and every admin account. |
| Attacker already inside the network | Nothing. | Review firewall, VPN and domain controller (Active Directory) logs for lateral movement. |
| Owner locked out | Nothing: you can’t update a device you can no longer log in to. | Treat the device as compromised and follow Fortinet’s recovery guidance, ideally with a clean configuration backup. |
Was your FortiGate installed a few years ago?
That’s the case for many SMBs in Laval, Montreal and the North Shore: a provider set up the firewall and VPN, and nobody has touched it since. First question to ask this week: who has the administrator password, and when was it last changed?
Signs your firewall has already had visitors
Based on the FBI advisory and Fortinet’s guidance, these should raise an eyebrow:
- An administrator or VPN account nobody recognizes. The advisory lists names often seen at victims, such as fortiAdmin, forticloud-sync, support_fortinet, adminsslvpn or itadmin. They are designed to look “official”.
- Your admin password no longer works, or an original account has vanished or been disabled.
- Admin logins from an unknown IP address, or VPN logins from unexpected locations.
- Password resets that nobody asked for.
- Configuration changes you didn’t approve (compare with a known-good backup).
- An API key nobody can explain.
- In Active Directory: new accounts, or a burst of failed logins across many accounts (a sign of password spraying).
The advisory also lists IP addresses observed between June and July 2026. The agencies note an address may have been reassigned since, so verify before blocking. If you see any of these signs, don’t just change the password: treat the firewall as compromised. If the firewall is linked to your Active Directory, also treat that binding account as compromised, as Fortinet recommends. Our decision tree for hijacked remote access can help you decide what to shut off first.
Your 30-minute action plan, in priority order
Do this with your IT provider or whoever manages the firewall. Before deleting anything, take screenshots: they will matter if an incident is confirmed.
Minutes 0 to 5 — Close the admin door
Check whether the firewall’s admin page is reachable from the internet. If it is, remove that access or limit it to trusted addresses.
Minutes 5 to 12 — Clean up accounts
List every administrator and VPN account. Note the ones nobody recognizes, then disable them. Close accounts belonging to former employees while you’re at it.
Minutes 12 to 20 — Kill sessions and change passwords
Terminate all active admin and VPN sessions, then reset every VPN and administrator password (long, unique, stored in a password manager). Remove unknown API keys.
Minutes 20 to 25 — Turn on (or schedule) MFA
MFA on the VPN and on every admin account. If the rollout takes longer, set a date this week.
Minutes 25 to 30 — Version, backup and logs
Note the FortiOS version, back up the configuration (once cleaned) and ask for a review of firewall and VPN logs. The campaign has been active since at least February 2026, according to SOCRadar.
Then, this week: move to the latest 7.4, 7.6 or 8.0 release, remove legacy password hashes per Fortinet’s guidance, and have your Active Directory logs checked. If personal information may have been affected, Quebec’s Law 25 generally provides for confidentiality incidents to be assessed and recorded; talk to a legal advisor. This is not legal advice.
An unmonitored firewall is one of the 5 signs your SMB is an easy target.
How NeoTech can help
For SMBs in Laval, Montreal and the North Shore, we can run this 30-minute plan with you, audit the accounts on your Fortinet firewall, set up MFA on the VPN and keep a clean configuration backup. Our automated 24/7 monitoring with an on-call technician response helps you spot a new admin account or an unusual login. See also our cybersecurity services.
Book your free cyber check
Not sure who holds the keys to your firewall, or whether MFA is on for your VPN? In a short meeting, we review it with you and prioritize the fixes.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- FBI and USSS — FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts (JCSA-20261006-01, October 6, 2026)
- CyberScoop — Alert: FortiBleed remains active campaign, can lock out users or lead to ransomware attacks (October 6, 2026)
- Fortinet — Analysis of Reported Credential Compromise of FortiGate Devices (June 19, 2026)
- SOCRadar — FortiBleed: The Campaign That Cracked 86,644 Firewalls
Photo: Brett Sayles (Pexels).