Reported by 7 outlets
FortiBleed Attackers Locking Victims Out of Fortinet Devices
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.90 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.32 / 0.6 · time to second source
- Recency
- × 0.08 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.7 / 10 = base × recency + community
Desk analysis
The FortiBleed campaign continues to target internet-accessible Fortinet FortiGate firewalls and SSL VPN appliances. SOCRadar confirmed approximately 86,644 compromised devices in 194 countries. A joint FBI/USSS advisory warns attackers lock organizations out by changing passwords and deleting accounts. The campaign started in June using previously compromised credentials and brute-force. The event includes a Daily Briefing reference and confirms no patch alone stops the access-broker activity; credential hygiene and account monitoring are critical.
Timeline
-
original reporting
FortiBleed Attackers Locking Victims Out of Fortinet Devices
securityweek.com · 5d ago · October 8th, 2026
The FortiBleed credential-harvesting and access-broker campaign is still active, and attackers are locking organizations out of their Fortinet devices. Targeting internet-accessible Fortinet FortiGate firewalls and SSL VPN appliances, the campaign started in June. Fortinet’s analysis of the attacks revealed that the attackers were using previously compromised credentials and brute-force techniques to take over poorly protected devices. Within a week, the attacks hit over 86,000 Fortinet devices in 190 countries, and a Russian initial access broker was blamed for the campaign. Now, SOCRadar says it has confirmed the compromise of approximately 86,644 devices in 194 countries. The attackers are searching for accessible firewalls and using compromised credentials to take them over. “[This] is a count of confirmed-compromised devices, not an exposure estimate. Devices breached months ago remain in the actors’ validated inventory,” SOCRadar notes. In a joint advisory (PDF) released this week, the FBI and the US Secret Service (USSS) warn that the hackers have been locking organizations out of their Fortinet appliances by changing passwords and deleting accounts. “Some victims may get locked out of their Fortinet devices if the threat actor either deletes or changes the password for original accounts on the system. In certain cases, threat actors delete existing accounts to block organizations from accessing affected devices and to maintai
-
update from www.securityweek.com
🚨🔒 SIGINT // Cybersecurity Watch — 2026-10-09 FBI warns FortiBleed credential-harvesting attacks now lock admins out of their own firewalls—
www.securityweek.com · 5d ago · October 8th, 2026
🚨🔒 SIGINT // Cybersecurity Watch — 2026-10-09 FBI warns FortiBleed credential-harvesting attacks now lock admins out of their own firewalls—
via Mastodon https://www.securityweek.com/fortibleed-attackers-locking-victims-out-of-fortinet-devices/
-
update from ninjalabz.io
🗞 Probably Fine Daily No. 12 FortiBleed: the patch is not the remediation, because the attacker has an account now Today's threat brief, rea
ninjalabz.io · 5d ago · October 9th, 2026
🗞 Probably Fine Daily No. 12 FortiBleed: the patch is not the remediation, because the attacker has an account now Today's threat brief, rea
via Mastodon https://ninjalabz.io/daily/2026-10-09/
-
update from ninjalabz.io
🗞 Probably Fine Daily N. 12 FortiBleed: la patch non è la remediation, perché l'attaccante ora dispone di un account Il brief di oggi sulle
ninjalabz.io · 4d ago · October 9th, 2026
🗞 Probably Fine Daily N. 12 FortiBleed: la patch non è la remediation, perché l'attaccante ora dispone di un account Il brief di oggi sulle
via Mastodon https://ninjalabz.io/daily/it/2026-10-09/
-
update from diesec.com
FortiBleed: owners locked out of their own firewalls South Korea: AI tool probed bank portals ASOS: breach announced via its own app Osaka:
diesec.com · 4d ago · October 9th, 2026
FortiBleed: owners locked out of their own firewalls South Korea: AI tool probed bank portals ASOS: breach announced via its own app Osaka:
via Mastodon https://diesec.com/2026/10/top-5-cybersecurity-news-october-09-2026/
-
update from cybertop.ai
CVE-2025-24472: Fortinet FortiOS and FortiProxy suffer an authentication bypass flaw, actively exploited. Defensive takeaway: Disable unused
cybertop.ai · 4d ago · October 9th, 2026
CVE-2025-24472: Fortinet FortiOS and FortiProxy suffer an authentication bypass flaw, actively exploited.
-
mentioned by hackread.com
FBI and Secret Service warn the FortiBleed campaign is still active, with SOCRadar reporting 86,000+ compromised FortiGate devices in 194 co
hackread.com · 4d ago · October 9th, 2026
-
mentioned by ninjalabz.io
🗞 Probably Fine Daily No. 12 FortiBleed: the patch is not the remediation, because the attacker has an account now Today's threat brief, rea
ninjalabz.io · 4d ago · October 10th, 2026
-
update from raymondtec.com
Daily Briefing: FortiBleed Can Lock Out Businesses, Plus 3 Stories https:// raymondtec.com/2026/10/fortibl eed-fortinet-warning-plus-3-stori
raymondtec.com · 3d ago · October 10th, 2026
Daily Briefing: FortiBleed Can Lock Out Businesses, Plus 3 Stories https:// raymondtec.com/2026/10/fortibl eed-fortinet-warning-plus-3-stori
via Mastodon https://raymondtec.com/2026/10/fortibleed-fortinet-warning-plus-3-stories/
-
mentioned by threatnoir.com
⚠️ CRITICAL: FBI Warns FortiBleed Campaign Still Active, Hits 86,000+ FortiGate Devices FortiBleed campaign is actively targeting 86,000+ Fo
threatnoir.com · 3d ago · October 10th, 2026