Fortinet’s PSIRT team has confirmed an active campaign — nicknamed FortiBleed — where threat actors are harvesting credentials from FortiGate firewalls. This is not a new vulnerability. Attackers are recycling credentials from two earlier incidents (FG-IR-26-060, FG-IR-25-647) and combining them with brute-force attacks against devices that have weak passwords and no MFA enabled. If your FortiGate is internet-facing, read this now.
The name “FortiBleed” refers to a credential-harvesting campaign first reported in June 2026. Threat actors are targeting FortiGate firewalls by reusing previously exposed credentials combined with automated brute-force techniques — exploiting organizations that haven’t rotated passwords after past incidents or enforced MFA on admin and VPN accounts.
Fortinet has contacted potentially impacted customers directly and is continuing its investigation in collaboration with relevant government agencies. If you haven’t heard from Fortinet, don’t assume you’re clear — proactive hardening is the right move regardless.
Fortinet’s official advisory lays out a clear priority order. Here’s what to do right now:
set login-lockout-upon-weaker-encryption.
If your team is running older FortiGate hardware — particularly models approaching end-of-support — this incident is a strong signal that it’s time to move to current-generation gear with up-to-date FortiOS. Models like the FortiGate 60F, FortiGate 70G, FortiGate 100F, and FortiGate 120G all run FortiOS 7.4+ natively, support PBKDF2 credential hashing, and are eligible for full FortiGuard security services. Running a supported, current platform is one of the best structural defenses you have.
Not sure which model fits your environment? Request a quote from DataCenter360.ca — as a Fortinet Select Partner, we can help you pick the right appliance and get it shipped fast.
Beyond Fortinet’s immediate checklist, here’s our practical take for Canadian SMBs running FortiGate:
We’ll update this post if Fortinet releases additional guidance. Bookmark the FortiGuard PSIRT portal for the latest advisories.
No. Fortinet has confirmed this is not a new vulnerability. The campaign exploits weak passwords and the absence of MFA — not a software flaw. Attackers are reusing credentials from previous incidents (FG-IR-26-060 and FG-IR-25-647) and augmenting them with brute-force techniques. Patching alone won’t protect you; credential hygiene and MFA are the required controls.
Check your FortiGate event logs for unexpected admin logins from unknown IPs. Look for newly created accounts (especially with names like forticloud, fortiuser, fortinet-support). Review VPN user lists for additions you don’t recognize. Also check domain controller logs for unusual authentication or lateral movement. Fortinet has published a recovery guide if you find signs of compromise.
FortiOS 7.4, 7.6, and 8.0 support PBKDF2 hashing for administrator credentials, which is significantly stronger than the hashing used in older versions. After upgrading, you must also run set login-lockout-upon-weaker-encryption to clear legacy password settings. All current-generation FortiGate hardware — including the 60F, 70G, and 120G — supports these firmware branches.
Yes. As a Fortinet Select Partner and MSSP, DataCenter360.ca can help you identify the right current-generation FortiGate for your environment, source it quickly, and advise on FortiCare licensing. Request a quote or visit our FortiGate product page to see what’s in stock.