FortiBleed leak exposes credentials for tens of thousands of Fortinet firewalls

The Canadian Centre for Cyber Security issued an alert on June 18, 2026, urging Fortinet customers to audit accounts and reset passwords after the discovery of a leaked trove of credentials for Fortinet firewalls and VPN gateways. The campaign behind it has been dubbed FortiBleed.

Stolen firewall credentials can let an attacker log in to a VPN or management console as a legitimate user, change security rules and move into internal networks without exploiting any software bug. The Cyber Centre's alert AL26-014 said abuse of the credentials could let attackers modify critical security controls.

What happened

Security researcher Bob Diachenko found an exposed server holding usernames, email addresses and plaintext passwords, BleepingComputer reported. He attributed it to a Russian-speaking, multi-operator group that left an open directory online. Hudson Rock counted 73,932 unique firewall URLs in 194 countries. Researcher Kevin Beaumont put the figure near 75,000 devices, roughly half of internet-accessible Fortinet firewalls, and confirmed some logins were real.

In a June 19 analysis, Fortinet said its initial review pointed to reuse of credentials stolen in earlier incidents, including those tied to its FortiCloud SSO advisories, and brute-force attacks against devices with weak passwords and no multi-factor authentication. The company said the activity was not a new Fortinet vulnerability and that it would contact affected customers.

Unlike January's FortiCloud single sign-on attacks, which exploited software flaws, FortiBleed is about stolen and guessed passwords. The Cyber Centre's alert still told organizations to confirm their firmware is current, singling out CVE-2024-55591, a FortiOS and FortiProxy authentication bypass from January 2025 that can grant super-admin rights, along with the SSO fixes covered in its earlier alert AL25-019.

What we don't know yet

How the credentials were first obtained has not been established, and no Canadian device count has been published. Later reporting linked the campaign to custom credential-sniffing tools and to the Lynx ransomware group.

What to do

• Inventory all accounts on Fortinet devices and remove suspicious or unneeded ones, such as accounts named forticloud-sync, forticloud-tech, forticloud or fortinet-support.
• End all active SSL VPN and administrative sessions, then reset VPN and admin passwords.
• Require multi-factor authentication on every external gateway and admin interface.
• Restrict management interfaces to trusted networks and hosts.
• Upgrade to current firmware; Fortinet notes that 7.4, 7.6 and 8.0 support stronger PBKDF2 hashing for admin passwords.
• Check logs for admin logins from unknown addresses and for lateral movement in domain controller logs.
•