The FBI and U.S. Secret Service warned this month that attackers tied to the FortiBleed campaign are still compromising internet-facing Fortinet FortiGate firewalls and SSL VPN gateways, using stolen or cracked credentials to get in—and, in a growing number of cases, changing passwords or disabling accounts so legitimate IT teams cannot log back in without a full recovery process.
The joint cybersecurity advisory, published Oct. 6, 2026, does not describe a new software bug so much as a sustained credential-harvesting operation. Researchers cited in the bulletin tracked more than 86,000 compromised appliances across 194 countries. For small and midsize U.S. businesses that expose VPN portals to the open internet, the practical risk is not only data theft but operational paralysis if an intruder locks the only admin account.
How FortiBleed gets a foothold
Investigators say the campaign combines reused passwords leaked from other breaches, password-spraying against VPN login pages, and exploitation of legacy password-storage schemes on older appliances. Once inside, attackers have been observed harvesting additional credentials, modifying firewall rules to maintain access, and—in ransomware-linked intrusions—using the VPN device as the first hop into flat internal networks.
Federal guidance stresses that patching alone may not evict an attacker who already captured valid credentials. Organizations need to assume VPN accounts that were active while a device was exposed must be rotated, not merely reset on the firewall console if that console is still under attacker control.
Lockouts and what they look like
Help-desk threads and incident-response firms have reported a pattern: administrators attempt to sign in to FortiGate management, receive authentication failures despite correct passwords, and discover secondary accounts disabled. In those cases, recovery may require out-of-band console access, factory-reset procedures, or restoration from offline backups—steps that take hours and can interrupt remote work for entire offices.
The FBI and Secret Service urge organizations to inventory every internet-facing Fortinet device, disable unused VPN accounts, enforce multifactor authentication on management interfaces where supported, and block management logins from arbitrary geographic regions if your workforce is domestic. They also recommend comparing running configurations against known-good backups; unauthorized VPN user additions are an early indicator in several documented cases.
Steps for home offices and managed-service customers
Employees who VPN into a corporate FortiGate should not ignore a sudden password failure after a routine patch window—report it immediately rather than retrying on a personal device. If your employer uses a managed service provider, ask whether the MSP monitors FortiGate authentication logs for impossible travel or off-hours admin logins.
Consumers rarely manage FortiGate hardware directly, but many franchise and medical practices do. If you run a business VPN on Fortinet gear, treat this advisory as a reason to schedule a credential reset weekend: bring the firewall offline briefly if needed, restore from a trusted backup, and reissue VPN profiles to staff rather than assuming a password change in the web UI is enough.
Reporting and indicators
The IC3 advisory includes indicators of compromise and hunting queries aimed at security teams. Businesses without a full SOC should still forward suspicious VPN logs to their cyber-insurance carrier or incident-response retainer, if they have one, because follow-on ransomware attempts have been linked to the same access path.
Fortinet continues to publish product security updates separately. Federal investigators emphasize pairing vendor patches with account hygiene: unique passwords per admin, hardware tokens where available, and removing SSL VPN exposure entirely if remote access can move to a zero-trust broker instead.
None of that eliminates risk overnight, but it addresses the failure mode that hurts operators fastest—being locked out of the device that is supposed to protect the network.