Fortinet has warned of an active credential-harvesting campaign, dubbed “FortiBleed,” targeting internet-facing FortiGate firewalls and VPN appliances worldwide. Unlike a zero-day attack, the campaign leverages credentials exposed in previously disclosed security incidents and combines them with AI-assisted brute-force techniques to gain unauthorized access. Researchers estimate that up to 86,000 FortiGate devices across 194 countries could be exposed, making this one of the largest credential-based threats affecting Fortinet environments.

Fortinet’s investigation found that attackers are primarily exploiting weak, reused, or previously compromised administrator and VPN credentials, particularly on systems where multi-factor authentication (MFA) is not enabled. The company emphasized that organizations that fully implemented remediation measures from earlier advisories are unlikely to be affected. Fortinet has also begun directly notifying potentially impacted customers and coordinating response efforts with government agencies.

Following successful authentication, threat actors have been observed modifying device configurations, creating unauthorized administrative accounts, and establishing persistent access to targeted environments. Common rogue account names include variations such as “forticloud,” “fortiuser,” and “fortinet-support.” In environments integrated with Active Directory (AD) or LDAP services, attackers may further leverage compromised access to move laterally across internal networks, increasing the risk of broader organizational compromise.

To mitigate the threat, Fortinet and CISA are urging organizations to immediately reset all VPN and administrative credentials, terminate active sessions, enforce MFA for all privileged accounts, and upgrade to supported FortiOS versions that provide stronger password protection mechanisms. Security teams should also audit configurations for unauthorized changes, review logs for suspicious administrative activity, restrict internet-facing management access, and investigate any signs of unauthorized account creation or unexpected password resets. Organizations identifying such indicators should consider affected devices fully compromised and initiate incident response and recovery procedures without delay.