CISA Warns Fortinet Customers as Forti Bleed Hits 86,644 Forti Gate Devices
Summary: CISA urged Fortinet customers with FortiGate appliances to secure against an ongoing campaign, codenamed FortiBleed and attributed to Russian-speaking threat actors, that has compromised 86,644 devices as of June 19, 2026. SOCRadar data shows generic admin accounts (35%) and built-in Fortinet system accounts (28.3%) make up most compromised credentials, with organization-specific accounts at 36.7%, and telecom, government, and education as the top impacted sectors.
Bottom line: The attackers built a verified database of working logins for internet-facing firewalls and VPN gateways across 194 countries, and Fortinet notes that administrator passwords upgraded from older FortiOS versions remain stored as SHA-256 hashes until each admin logs in - so patching alone may not have rotated the credentials now in that database.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026