Mass FortiGate Credential Leak Enables Widespread Remote Network Access

Du'aine Davis

• In June, researchers identified a dataset containing valid administrative credentials for ~75,000 internet-facing Fortinet FortiGate firewalls. The data appears recent and largely distinct from earlier leaks, with most affected devices still online. Impact spans global organisations, representing roughly half of exposed Fortinet devices. With valid credentials, attackers can directly access firewalls and, by extension, internal corporate networks.
• The dataset originates from exported device configuration files containing hashed (and in some cases crackable) admin credentials. The exact intrusion vector is unknown, but likely involves exploitation of known FortiGate vulnerabilities or potentially a new flaw, echoing prior zero-day-driven config theft. Credential storage weaknesses allowed offline cracking. Data formatting suggests circulation within eCrime ecosystems as monetised initial access.
• Affected organisations are advised to immediately rotate all admin credentials, upgrade to the latest FortiOS, and enforce MFA on firewall management accounts. Remove internet exposure of management interfaces where possible. In Microsoft Defender/XDR, monitor for anomalous remote admin logins to network devices, suspicious authentication spikes, and post-auth configuration changes indicative of persistence (e.g., new admin accounts).

FortiBleed — 75k Fortinet firewalls have admin passwords cracked | by Kevin Beaumont | Jun, 2026 | DoublePulsarFortiBleed — 73,932+ Compromised Fortinet Firewalls | Hudson Rock | Hudson Rock