FortiBleed: when tens of thousands of firewalls become an open door

FortiGate firewalls protect corporate networks. That is their sole purpose. What FortiBleed shows: when the firewall itself becomes the attack surface, it no longer protects – it opens up.

What is FortiBleed?

FortiBleed is not a single breach. It is an industrialised harvesting operation against internet-exposed Fortinet firewalls and SSL VPN gateways. The dataset was discovered in mid-June 2026 by security researcher Volodymyr "Bob" Diachenko.

The scale is extraordinary, even though the exact figures vary by source and are still changing, as the campaign was still active at the time of publication. Security researchers who analysed the leaked dataset estimate the number of affected FortiGate devices at somewhere between 30,000 and 75,000. The entries it contains can be attributed to around 21,600 domains in 194 countries – a cross-section of global corporations, public authorities and critical infrastructure operators across almost every industry.

How the attack worked

The attack follows an automated, self-reinforcing chain. First, the internet is scanned for reachable FortiGate devices, above all SSL VPN endpoints and management interfaces. Against each device found, the attackers then test a curated list of known passwords. A successful login is not followed by a noisy attack. Instead, the compromised device is used as a silent "listening post": it sits at the network perimeter and reads the traffic passing through in order to harvest further credentials. These flow back into the scanner and compromise the next device. The system feeds itself.

The password list being tested is not random. It consists of credentials that had already leaked in earlier Fortinet incidents and through infostealer logs – many organisations never changed their passwords after a previous incident. In addition, according to Diachenko's reconstruction, the attackers intercepted SSL VPN authentication hashes and cracked them offline with a GPU cluster (a Hashtopolis-managed setup of around 45 GPUs has been reported).

As things stand, this is not a confirmed zero-day. How the configuration data originally left the devices remains open. Candidates include known but unpatched vulnerabilities (in particular CVE-2026-24858, a FortiCloud SSO SAML bypass with a CVSS score of up to 9.8), a still-unknown flaw, credentials from infostealers, or a combination of these. A further contributing factor is that on many devices admin passwords are still stored in the older SHA-256 format, namely wherever admins never logged in again after a firmware update. In any case, the core of the problem remains the same: exposed management interfaces and reused or crackable credentials.

The role of infostealers

A significant share of the credentials does not come from classic brute force but from infostealer campaigns. Infostealer malware on employee devices steals saved VPN credentials and passwords from browsers and password managers, which then end up in dark web forums and dumps. In many cases these credentials enabled a valid login without any brute force at all.

That also makes FortiBleed a topic for dark web monitoring: the infostealer activity that led to these credentials was visible in the relevant forums and dumps – to anyone actively looking there.

What helps – and why visibility is decisive

This is exactly where blacklens.io comes in. Dark Web Monitoring detects when credentials or infostealer activity affect your own company, and the early warning system in the Threat Center proactively informs you about new vulnerabilities in your systems. Continuous analysis of the attack surface through Attack Surface Management shows which systems are really reachable from the outside – including the ones nobody internally remembers any more.