Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 1:00 PM EST
Fortinet Credential Leak Fallout
Coverage from BleepingComputer, Security Affairs, and others
Articles
8
Active Days
94
The Topic
Fortinet VPN and firewall credentials were exposed at large scale, affecting tens of thousands of internet-facing devices and prompting government advisories, vendor warnings, and urgent password-reset guidance. The reporting also points to access brokering and credential cracking as part of the same compromise pattern.
First Article: 03/30/26
Latest Article: 07/01/26
Summary
- Large credential exposure remains the dominant pattern, with reports converging on roughly 74,000 to 75,000 Fortinet devices and firewall URLs.
- The exposed data includes usernames, email addresses, and passwords tied to FortiGate SSL VPN and firewall access, making the material immediately usable for intrusion.
- Researchers and agencies link the leak to offline hash cracking, brute-force testing, and broader access-brokering activity rather than a single isolated breach.
- Government and security responses are consistent: reset VPN and admin passwords, enable phishing-resistant MFA, review logs, and remove public access to management interfaces.
- The same dataset is described as spanning many countries and organizations, including major companies and public-sector targets, which broadens its operational impact.
- Fortinet devices remain a recurring exposure point because public management interfaces, stored credentials, and VPN access are all involved in the same risk surface.
History
This topic is new, but as new articles are added to it this area will summarize shifts, changes and expansions of the issues.
Featured
06-19-2026
CISA urged Fortinet FortiGate customers to reset SSL VPN and administrative credentials after FortiBleed exposed nearly 74,000 leaked access records.
06-17-2026
Hudson Rock reported FortiBleed credential exposure in Fortinet FortiGate SSL VPN environments after researchers found leaked VPN usernames, emails, and plaintext passwords.
07-01-2026
SOCRadar linked FortiBleed credential theft from exposed Fortinet FortiGate devices to INC and Lynx ransomware groups in 2024-2025 investigation findings.
Timeline: 94 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Hudson Rock and Kevin Beaumont, building on Bob Diachenko's findings, published guidance after a Fortinet VPN credential dataset exposed tens of thousands of internet-facing devices.
In June 2026, researcher Volodymyr Bob Diachenko uncovered FortiBleed, a leaked credential set exposing valid Fortinet firewall logins worldwide via an access-brokering vendor.
Hudson Rock reported a Fortinet firewall and VPN credential theft campaign in more than 15 countries, involving large-scale device compromises and potential intrusions at companies and agencies.
⭐⭐⭐
DGSSI warned on June 18 that FortiBleed exposed administrator credentials for Fortinet FortiGate and SSL VPN devices impacting Morocco and tens of thousands of systems globally.
⭐️⭐️
Defused says attackers began exploiting CVE-2026-21643 in Fortinet FortiClient EMS, with CISA not yet listing it, while scans show thousands of exposed EMS interfaces.