74,000 FortiGate Devices Exposed: CISA Orders Immediate Credential Reset

CISA just dropped an emergency alert: roughly 74,000 internet-accessible Fortinet devices have their credentials leaking in the wild under a campaign called FortiBleed. Half of the internet-facing FortiGate fleet may already be compromised, and attackers aren't waiting for an invitation.

FortiBleed's Scope: 74,000 Devices and Counting

Multiple threat intelligence firms - Tech Times, SOCRadar, Hudson Rock, Arctic Wolf - all independently tracked this. The numbers converge around 74,000 FortiGate firewalls and SSL VPN gateways, spanning 194 countries. Government and private sector alike. These aren't theoretical vulnerabilities; they're leaked credentials being actively used to log in.

CISA's Playbook: Terminate, Reset, Harden

CISA's guidance is refreshingly blunt. Terminate all active SSL VPN and administrative sessions right now. Reset every Fortinet VPN and admin password, especially on internet-facing systems. Review your firewall, VPN, authentication, and domain controller logs for lateral movement or suspicious accounts. Enable phishing-resistant MFA on all remote access and admin accounts, enforced on every external gateway.

Lock down management access too. If your FortiGate administration interface is reachable from the public internet, that's a priority fix. Restrict it to trusted internal networks. Remove or disable any unauthorized accounts.

The One Setting That Matters: PBKDF2

Here's the technical detail most teams will miss. CISA explicitly calls out confirming your use of the Password-Based Key Derivation Function 2 (PBKDF2) algorithm to store administrator credentials. Fortinet's guidance in FortiOS v7.2.11 and later tells you how to enforce it. Weak legacy hashes need to die. If you're still on an old hash, your admin passwords might as well be plaintext.

What Comes Next

This campaign isn't slowing down. Attackers move faster than most patch cycles. The 74,000 figure is a snapshot, and more credentials will surface. The playbook is clear: terminate, reset, harden, and don't skip PBKDF2. Your FortiGate's admin password is the key to your entire network. Treat it like one that's already been copied.

Source: CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure
Domain: cisa.gov