Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries

In mid‑June 2026 researchers disclosed “FortiBleed,” an active large‑scale campaign that extracted FortiGate configuration files and cracked stored administrator password hashes, yielding verified credentials for approximately 30,000–75,000 internet‑facing Fortinet firewalls across 194 countries; the issue is driven by legacy SHA‑256 password hashes retained after upgrades. The report documents scale, attribution of operational infrastructure, and prescribes mitigations: rotate credentials, enable MFA, restrict public management access, and enforce PBKDF2 hashing.