CISA issued an emergency hardening alert on June 18, 2026, after a credential harvesting campaign dubbed FortiBleed exposed valid administrator and VPN credentials for tens of thousands of internet-facing Fortinet firewalls across government and private sector organizations worldwide.¹ No new vulnerability was exploited.² The attackers used stolen credentials, brute force, and exposed management interfaces.

What FortiBleed Is — and Why It Is Different

On June 13, 2026, security researcher Volodymyr Diachenko discovered an open server containing valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations.⁵ Security researcher Kevin Beaumont and Hudson Rock independently confirmed the dataset.⁵ By June 19, the confirmed device count had reached approximately 86,644 unique devices across 194 countries, representing roughly half of all internet-facing Fortinet firewalls.⁶

FortiBleed is not a CVE story. There is no patch that closes it. The attackers harvested credentials through a combination of exposed management surfaces, brute-force attacks, credential material recovered from exported Fortinet configuration files, and GPU-based offline password cracking against legacy hash formats. Fortinet's own assessment describes the activity as threat actors reusing credentials from previous incidents and brute-forcing devices with weak password hygiene and no MFA.²

CISA Alert — June 18, 2026
CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials. This activity, referred to as FortiBleed, involves the exposure of leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network (VPN) gateways.¹

The dataset is structured as a sales catalog. Each entry includes the target organization's industry, revenue, employee count, and country.⁴ It was not assembled for personal use. It was assembled for sale or coordinated deployment across a criminal team.^4-5 An attacker with these credentials can log in remotely, access the firewall and therefore the network behind it, change security settings, and use the device as a persistent foothold.

Exposure Analysis: What the Attackers Had and What They Could Do With It

Companies appearing in the dataset including many confirmed by Hudson Rock, were Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle, and numerous government agencies and critical infrastructure operators.⁴ The dataset spans 21,632 unique domains.⁵ The breadth is not incidental — it is the product.

A credential campaign targeting half the internet-facing Fortinet fleet does not trigger exploit signatures, does not deploy malware at the entry point, and does not announce itself in any way that a perimeter block or intrusion detection system is designed to catch. The detection problem is precisely that the abuse resembles legitimate administrative activity: valid credentials, valid usernames, successful authentication.

Root Cause: Three Design Decisions That Made This Possible at Scale

FortiBleed is not primarily a Fortinet security failure. It is the industrialization of three perimeter security anti-patterns that have been documented for years.

Recommended Actions: What CISA Is Directing Organizations to Do

CISA's June 18 alert names five specific immediate actions for all impacted Fortinet customers with FortiGate appliances and SSL VPN gateways.¹ For federal civilian agencies, these actions are mandatory under existing binding operational directives.

How BlackBerry Secure Communications Addresses the FortiBleed Threat Class

FortiBleed represents a threat class, not a single incident. Credential-based initial access against perimeter devices is now the dominant technique across nation-state and organized criminal campaigns targeting government and critical infrastructure. Once inside the network perimeter, an attacker controls the infrastructure that communications, identities, and emergency coordination depend on. The relevant question is not only how to prevent perimeter compromise, but what remains protected and operational after it succeeds.

The perimeter device is no longer outside the threat model. It is the entry point. Organizations whose communications, identity enforcement, and emergency coordination all depend on the integrity of the network perimeter have no resilience layer when that perimeter is the incident.

BlackBerry Position

FortiBleed did not require a new vulnerability. It required valid credentials, an internet-exposed management interface, and an absence of MFA. The attackers assembled all three at scale across 194 countries. A compromised perimeter device does not just expose the network behind it — it exposes every communication, every coordination channel, and every identity operating through it. BlackBerry UEM enforces device posture and access policy controls that limit what a compromised perimeter device can reach. BlackBerry SecuSUITE removes voice and data communications from the carrier and platform infrastructure that FortiBleed-class attacks are designed to traverse. BlackBerry AtHoc ensures that when perimeter infrastructure is compromised, emergency coordination and crisis communications operate through an independent, authenticated, out-of-band channel that does not depend on the compromised environment.

Citations:

1. CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure (CISA, June 22, 2026)

2. Analysis of Reported Credential Compromise of FortiGate Devices (Fortinet PSIRT, June 19, 2026).

3. FortiBleed: 75,000 Fortinet Firewalls Compromised, Global Enterprises Exposed (Hudson Rock, June 17, 2026).

4. Technical Advisory: FortiBleed Credential Exposure Campaign Targeting Internet-Facing Fortinet Devices (Bitdefender, June 22, 2026).