The Fortinet VPN Credential Leak: What FortiBleed Means for VPN Security
Why exposed firewall and VPN passwords can be just as dangerous as a new software vulnerability
The Fortinet VPN credential leak is a large credential-exposure story involving Fortinet FortiGate firewalls and VPN gateways. It is widely being discussed under the name FortiBleed.
The important point is that this is not just a normal “patch this bug” story. Fortinet has said the activity is not related to a recent Fortinet incident or advisory and has described it as involving data from previous incidents plus brute forcing or credential reuse. That means the biggest immediate risk is attackers using valid usernames and passwords rather than relying only on a newly disclosed software flaw.
For businesses, the lesson is simple: a VPN gateway can be fully encrypted and still be dangerous if old, reused or exposed credentials let attackers log in through the front door.
Treat FortiBleed as an identity and access-control emergency. Rotate credentials, enforce MFA, review logs, terminate suspicious sessions and remove public management access wherever possible.
Credentials exposed
Reports describe exposed usernames, email addresses, plaintext passwords and FortiGate firewall or VPN URLs.
Tens of thousands of targets
Public reporting has described datasets involving roughly 74,000 Fortinet or FortiGate firewall URLs, though figures vary by source.
Not a new advisory
Fortinet says the campaign is not tied to a recent Fortinet incident or advisory and points to previous data, brute forcing and credential misuse.
MFA and rotation
Stolen passwords become much less useful when strong MFA, unique passwords and restricted management access are in place.
What Happened in the Fortinet VPN Credential Leak?
A large cache of Fortinet-related firewall and VPN credentials was reportedly discovered and linked to a campaign now being called FortiBleed. The data reportedly included FortiGate firewall URLs, usernames, email addresses and plaintext passwords for organisations around the world.
FortiGate devices are often used as firewalls, VPN gateways and remote-access entry points. That makes credential exposure especially serious. If attackers have working administrator or VPN credentials, they may be able to access a company network without needing to exploit a fresh vulnerability.
This is why national cyber-security agencies and researchers have focused their advice on credential rotation, MFA, log review, device hardening and reducing exposed internet-facing management interfaces.
Why This Leak Matters More Than a Normal Password Dump
A leaked password for a shopping account is bad. A leaked password for a firewall or VPN gateway can be much worse.
Firewalls and VPN gateways sit at the edge of a network. They decide who gets in, what traffic is allowed and which remote users can reach internal systems. That means a successful login can give attackers a trusted path into an organisation.
The most worrying part is that this type of access can look normal at first. A login with a real username and password may not trigger the same alerts as obvious malware or a known exploit attempt. Attackers can use that access to explore the device, add accounts, change settings, harvest more credentials or move deeper into the network.
The bigger lesson: VPN security is no longer only about encryption or software patches. It is also about identity security, password hygiene, MFA, access restrictions and continuous monitoring.
Is FortiBleed a New Fortinet Vulnerability?
Fortinet’s position is that the reported activity is not connected to a new Fortinet vulnerability, recent incident or recent advisory. The company has said attackers are using information from previous incidents and brute-forcing credentials.
That distinction matters, but it should not make organisations relax. A credential incident can be just as dangerous as a software vulnerability if the credentials still work.
A patch closes a known technical hole. A password reset closes a stolen-login hole. If an attacker already logged in before the reset, the organisation may also need to investigate configuration changes, backdoor accounts, suspicious tunnels, altered policies and unusual administrator activity.
FortiBleed Risk Table: What Could Go Wrong?
| Risk | Why it matters | What to check |
|---|---|---|
| Working VPN credentials | High risk | Reset VPN user passwords, enforce MFA and review remote-access logs for unusual countries, times or IP addresses. |
| Administrator account exposure | Critical risk | Terminate admin sessions, rotate admin credentials, audit new admin accounts and check configuration changes. |
| Public management interface | Avoidable exposure | Remove management access from the public internet or restrict it to trusted IP addresses and secure admin networks. |
| Password reuse | Common weakness | Check whether the same password appears on other systems, especially domain, email, cloud and admin accounts. |
| Old FortiOS version | Broader attack surface | Update FortiOS and review Fortinet hardening guidance, even if the immediate issue is credential-based. |
| No MFA | Stolen password works alone | Enable MFA for VPN users, administrators and any account with remote or privileged access. |
How Attackers Can Use Leaked VPN Credentials
Attackers do not always need to break software. Sometimes they only need a login that still works.
With valid VPN or firewall credentials, an attacker may try to establish remote access, inspect network routes, test internal systems, add a backup account, change firewall policies, disable security controls or harvest additional credentials from connected environments.
In the worst cases, this can become the starting point for data theft, ransomware, business-email compromise, espionage or long-term network persistence.
Initial access
Attackers may use valid VPN credentials to enter a network without triggering obvious exploit alerts.
Privilege escalation
If admin credentials are exposed, attackers may modify settings, accounts, policies and access controls.
Lateral movement
Once inside, attackers may test access to file servers, identity systems, email platforms and cloud services.
Persistence
Attackers may create new accounts or configuration changes designed to survive a simple password reset.
Fortinet VPN Credential Leak Timeline
Researchers report FortiBleed activity
Security researchers and news outlets describe a large Fortinet/FortiGate credential dataset and a campaign targeting firewall and VPN access.
Fortinet acknowledges credential harvesting
Fortinet says it is aware of a credential-harvesting campaign against firewall and VPN devices and says the activity is not tied to a recent advisory.
Public reporting describes exposed FortiGate URLs
Reports describe a dataset involving tens of thousands of Fortinet or FortiGate firewall URLs, along with account data and passwords.
NCSC issues advice
The UK National Cyber Security Centre urges organisations using Fortinet services to take action after global targeting of firewalls and VPN gateways.
Current position
Organisations should treat exposed Fortinet VPN and firewall credentials as potentially serious until logs, sessions, accounts and configurations have been reviewed.
What Fortinet Customers Should Do Now
If your organisation uses Fortinet FortiGate firewalls, SSL VPN or exposed management interfaces, do not treat this as a headline-only issue. Treat it as a practical access-control review.
- Check official Fortinet, NCSC, ACSC and incident-response guidance for the latest indicators and mitigations.
- Reset Fortinet VPN user passwords and administrator passwords, especially on internet-facing devices.
- Terminate active VPN and administrator sessions before or during credential rotation.
- Enable multi-factor authentication for VPN, administrator and remote-access accounts.
- Review logs for unexpected logins, unusual IP addresses, failed login bursts and suspicious administrator activity.
- Audit local users, admin groups, firewall policies, VPN portals, routing changes and newly created accounts.
- Update FortiOS and apply Fortinet hardening guidance.
- Remove management interfaces from the public internet or restrict access to trusted IP addresses.
- Check whether exposed credentials were reused on email, cloud, domain or third-party systems.
- Escalate to incident response if there is evidence that an attacker logged in or changed device configuration.
What Ordinary VPN Users Can Learn from FortiBleed
Most home VPN users are not running Fortinet FortiGate appliances. This story is mainly about business firewalls and VPN gateways, not consumer VPN apps used for privacy or streaming.
However, the lesson applies to everyone: a strong privacy tool is only as safe as the account protecting it. Reused passwords, old passwords and missing MFA create risk on almost any online service.
Use a password manager, create unique passwords, turn on MFA and pay special attention to accounts that provide remote access, admin rights or financial control.
Common Myths About the Fortinet VPN Credential Leak
Frequently Asked Questions
What is the Fortinet VPN credential leak?
It is a reported credential exposure and harvesting campaign involving Fortinet FortiGate firewalls and VPN gateways. Reports describe exposed usernames, emails, passwords and device URLs that could allow attackers to attempt access to affected environments.
Is FortiBleed the same as a Fortinet breach?
Not exactly. Fortinet says the activity is not related to a recent Fortinet incident or advisory. The practical issue is that credentials linked to Fortinet firewall and VPN access may have been exposed or abused.
Is FortiBleed a new Fortinet vulnerability?
Fortinet says it is not tied to a recent vulnerability or advisory. The company has described the campaign as involving previous data, brute forcing and credential reuse. Organisations should still patch and harden devices because older vulnerabilities and weak credentials can combine.
Why are Fortinet VPN credentials so sensitive?
Fortinet VPN and firewall accounts can sit at the front door of a business network. A valid login may let attackers access internal systems, change configuration, add accounts or move deeper into the environment.
What should Fortinet customers do immediately?
Rotate VPN and admin credentials, terminate active sessions, enforce MFA, review logs, check for new or changed accounts, update FortiOS and remove public management access where possible.
Does this affect consumer VPN apps?
This story mainly affects organisations using Fortinet FortiGate firewalls and VPN gateways. It is not the same as a leak from consumer VPN apps, but it still shows why unique passwords and MFA matter.
Can MFA stop this type of attack?
MFA can greatly reduce the risk that a stolen password works by itself. It does not replace patching, logging or access restrictions, but it is one of the most important controls for VPN and administrator accounts.
Should organisations remove exposed Fortinet management interfaces?
Yes, where possible. Management interfaces should not be open to the public internet. Restrict access to trusted IPs, secure admin networks or other controlled access paths.
Sources Used for This Fortinet VPN Credential Leak Explainer
This article separates Fortinet’s own position from public reporting and national cyber-security guidance. Readers responsible for Fortinet environments should check official advisories directly before making operational decisions.
- Fortinet PSIRT: Analysis of reported credential compromise of FortiGate devices
- UK NCSC: Advice following global targeting of Fortinet firewalls and VPN gateways
- ASD ACSC: Reported widespread credential exposure affecting Fortinet firewalls and VPN gateways
- Reuters: Fortinet says credential-harvesting campaign is targeting its firewalls and VPN devices
- BleepingComputer: FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices
- Recorded Future: FortiBleed campaign exposing credentials for FortiGate systems