CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

A global campaign named 'FortiBleed' has compromised 86,644 internet-facing Fortinet FortiGate firewalls and VPN gateways by mass-scanning for remote login endpoints and using credential-stuffing/brute-force against default, leaked, and org-specific credentials; attackers then passively harvested additional credentials to scale the campaign. CISA and other agencies warn customers to reset passwords, terminate sessions, enable MFA, ensure PBKDF2 password storage, and review logs, while vendors note some data may be reshared from prior incidents.