CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices
A global FortiBleed campaign has exposed admin credentials on up to 86,644 FortiGate firewalls, prompting a CISA warning.
Velocity
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The brief
FortiBleed is a credential‑exposure campaign targeting Fortinet FortiGate devices. Reported numbers range from 73,932 compromised firewalls to 86,644 devices, with coverage noting impact across 194 countries and describing the breach as affecting roughly half of the internet‑facing fleet.
Coverage from Recorded Future, Arctic Wolf, csoonline.com, CloudSEK, DoublePulsar, Tech Times, InfoStealers, Ars Technica and The Hacker News highlights technical details, the scale of exposure and the issuance of a formal warning by the Cybersecurity and Infrastructure Security Agency (CISA) to Fortinet customers. Analysts will watch for further updates from CISA, Fortinet and affected organizations, including any remediation guidance, patch releases or additional advisories that may follow the initial warning.
Synthesized by PULSE from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 136d ago.
Quick answers
What is the FortiBleed campaign?
It is a campaign that has exposed admin credentials for Fortinet FortiGate firewalls, with reported compromise of tens of thousands of devices.
How many FortiGate devices are reported compromised?
Reported figures include 73,932 firewalls, 75,000 firewalls and an upper count of 86,644 devices, according to various outlets.
What geographic scope does the breach cover?
Coverage indicates the campaign is active in 194 countries.
What official response has been issued?
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to Fortinet customers about the FortiBleed exposure.
Coverage (10)
- FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems Recorded Future · 140d ago
- Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries Arctic Wolf · 140d ago
- FortiBleed campaign exposes 75,000 Fortinet firewalls worldwide csoonline.com · 140d ago
- Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind CloudSEK · 140d ago
- An update on FortiBleed — what’s happening with victim orgs | by Kevin Beaumont DoublePulsar · 140d ago
- Fortinet FortiGate Credential Leak Hits 73,932 Firewalls: Half the Internet-Facing Fleet Tech Times · 140d ago
- FortiBleed: 75,000 Fortinet Firewalls Compromised: Global Enterprises Exposed InfoStealers · 140d ago
- Massive breach spills credentials for thousands of sensitive networks Ars Technica · 140d ago
- FortiBleed — 75k Fortinet firewalls have admin passwords cracked | by Kevin Beaumont DoublePulsar · 140d ago
- CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices The Hacker News · 140d ago
Topics
Related trends
GhostMap: an app can brick Android device, leaving it in crash loop
An Android flaw named GhostMap can trap mobile devices in a persistent crash loop before any applications can be opened.
Vulnerability allows attackers to log into some Linux devices sans password
A newly reported OpenSSH flaw allows attackers to access password-disabled accounts on certain Linux systems.
Exclusive | AI Security Startup Sentra Raises $150 Million to Police Autonomous Agents
AI security startup Sentra has raised $150 million to control data access for autonomous agents.
OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run
OpenAI’s GPT‑6 Cyber model churned 948 Linux root‑escalation bugs in a 30‑hour run, igniting debate over AI‑driven cyber risk.
Hackers Exploit Patched Apple Flaw to Deliver Info-Stealing Malware, CISA Says
Hackers weaponize a patched Apple flaw and Android bugs, sparking alerts from CISA and multiple security outlets.
Kyiv Independent hit by suspected Russian cyberattack
The Kyiv Independent faces a suspected Russian cyberattack, drawing urgent scrutiny from digital security reporters.