CISA warns Fortinet users to secure devices after FortiBleed leak

What We Know

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned Fortinet customers to secure and harden internet-accessible Fortinet devices after reports of a credential-harvesting campaign dubbed “FortiBleed.” Multiple security outlets report that threat actors collected FortiGate device credentials at scale; industry reporting cites tens of thousands of exposed device credentials (for example, SecurityWeek reports about 86,000 compromised credentials, while CSO Online cites roughly 75,000 exposed FortiGate firewalls worldwide). Fortinet publicly acknowledged reports of malicious actors targeting its devices and published an analysis of the reported credential compromises (Fortinet blog, June 19, 2026).

Researchers and vendors that examined the activity describe it as a global access-broker style campaign. SpyCloud published an analysis of infrastructure associated with the FortiBleed actors, and security outlets note the campaign’s wide geographic reach (CSO Online references exposure across 194 countries). Security reporting and Security Affairs say there are warnings of active exploitation following the leak. In response, CISA and other commentators are urging organizations to harden devices exposed to the internet and follow remediation guidance to prevent or limit unauthorized access.