Are the Credentials Real?

Unfortunately, many appear to be.

Security researchers independently tested portions of the dataset and confirmed that some credentials were valid.

That matters.

A leaked password is concerning.

A leaked password that still unlocks an administrator account is an active security incident.

And because FortiGate devices often sit at the edge of corporate networks, access can give attackers a powerful starting point.

They are not entering through a forgotten employee laptop.

They may be entering through the system designed to control everyone else.

How Did This Happen?

Despite the name, FortiBleed does not appear to be one brand-new zero-day vulnerability.

The operation reportedly relied on a mix of familiar weaknesses:

• Internet-facing management interfaces
• Weak or reused passwords
• Missing multi-factor authentication
• Brute-force login attempts
• Older password hashes extracted from configuration backups
• Credentials left unchanged after previous incidents

Attackers allegedly attempted more than a billion credential combinations.They also reportedly used a large GPU setup to crack weaker password hashes offline.This was not necessarily sophisticated magic.It was industrial-scale persistence.Try enough doors.Collect enough keys.Crack enough combinations.Eventually, something opens.

Why This Is So Dangerous

A firewall is supposed to be the security checkpoint.

It decides who enters.

It controls remote access.It separates trusted systems from the public internet.

But valid administrator credentials can allow an attacker to:

• Change firewall rules
• Create new accounts
• Disable security controls
• Access VPN services
• Move deeper into the network
• Steal sensitive data
• Prepare ransomware attacks
• Maintain long-term access

Think of it this way:The attacker is not drilling through the vault wall.They are opening the front door, entering the correct code, and acting like they belong there.

The Scale of the Exposure

Researchers found credentials linked to organizations across government, critical infrastructure, healthcare, manufacturing, telecommunications, and major global corporations.

Some well-known company names reportedly appeared in the dataset.But an organization appearing in the leak does not automatically mean its entire network was breached.It means the risk must be taken seriously.A leaked vault combination may be outdated.It may have been changed.Or it may still work perfectly.You do not wait for a robbery to find out.

Fortinet’s Response

Fortinet has said the incident does not appear to involve a new vulnerability in its products.Instead, the company points to credential reuse, brute-force activity, exposed services, and information connected to previous incidents.

Fortinet has urged customers to:

• Rotate credentials immediately
• Enable MFA
• Restrict public access to management interfaces
• Follow current hardening guidance
• Update affected systems

Fortinet has also improved password protection in newer software versions.But stronger hashing only helps when organizations complete the required update and authentication steps.Installing a better vault lock does not help if the old combination still opens the door.

What Organizations Should Do Now

If your organization uses Fortinet FortiGate devices, treat this as an urgent exposure review.

1.Check Your Public Exposure

Identify every Fortinet device reachable from the internet.

Pay particular attention to:

• Administrative login portals
• SSL VPN services
• FortiOS management interfaces
• Related Fortinet products with public-facing access

2.Rotate Credentials

Change all administrator and VPN passwords.

Do not only change the obvious account.

Review:

• Local administrator accounts
• Service accounts
• VPN users
• Shared credentials
• Emergency access accounts
• Passwords reused elsewhere

A compromised password often travels further than expected.

3.Enable MFA

Passwords should not be the only thing standing between an attacker and your firewall.

Enable multi-factor authentication wherever supported.

Especially for:

• Administrators
• Remote-access users
• Privileged accounts
• Third-party support accounts

4. Remove Management Interfaces From the Internet

Administrative portals should not be publicly available unless absolutely necessary.

Use:

• A secure VPN
• A jump server
• Trusted IP restrictions
• Dedicated management networks
• Zero-trust access controls

The fewer people who can see the vault keypad, the fewer people can try the combination.

5.Investigate for Compromise

Do not assume a password rotation solves everything.

Review logs for:

• Unusual login locations
• Repeated failed authentication attempts
• Unexpected administrator sessions
• New user accounts
• Modified firewall rules
• Changed VPN settings
• Unknown configuration exports
• Suspicious internal traffic

If your device appears in the dataset, assume the credentials may have been used.

Then investigate accordingly.

The Bigger Lesson

FortiBleed is not only a Fortinet story.It is a credential-security story.Organizations spend heavily on firewalls, VPNs, endpoint platforms, cloud tools, and monitoring systems.

But expensive security technology can still be undermined by:

• Weak passwords
• Reused credentials
• Missing MFA
• Public management interfaces
• Poor asset visibility
• Forgotten legacy configurations

You can buy the strongest vault in the world.But if the combination is weak, exposed, or never changed, the steel does not matter.

The Cybernara View

At Cybernara, we see FortiBleed as a reminder that security products must be secured too.

A firewall is not automatically safe because it is a firewall.It still needs strong identity controls, restricted access, proper monitoring, regular updates, and continuous exposure management.Organizations should know exactly which management interfaces are publicly reachable.They should know where privileged credentials are stored.They should know whether MFA is enabled.

And they should know when those credentials appear in underground datasets.Because attackers do not care whether access came from a zero-day, a leaked backup, a reused password, or an exposed login page.They only care whether the combination works.

TL;DR

•  FortiBleed exposed credentials linked to tens of thousands of Fortinet firewalls worldwide.
•  The dataset reportedly spans 194 countries.
•  Researchers confirmed that some leaked administrator credentials were valid.
•  The campaign appears to involve brute force, password cracking, credential reuse, and exposed management interfaces—not one confirmed new zero-day.
•  Valid firewall credentials can enable network access, configuration changes, data theft, espionage, and ransomware.
• Organizations should rotate credentials, enable MFA, remove public management access, update devices, and investigate for signs of compromise.
• The firewall may still be working exactly as designed.
• The problem is that someone else may know the vault combination.

If you’d like help navigating this or improving your security posture, reply to this email or reach out to Cybernara.