FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins
-
The FBI has issued a new warning that FortiBleed attacks remain active, targeting internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways. The campaign focuses on devices that are reachable from the public internet, with attackers moving to lock legitimate administrators out of the very appliances they are supposed to manage.
According to the advisory, the activity is ongoing rather than historical, meaning organizations running affected FortiGate systems should treat this as an active threat. The core impact described is administrative lockout: once intruders gain a foothold, they can modify credentials and access controls so that real admins are shut out, complicating both detection and recovery.
Because the source material does not provide specific CVE identifiers or affected version numbers for this campaign, administrators should rely on Fortinet's own guidance and the FBI's bulletin for authoritative technical details rather than any third-party list of identifiers.
Recommended steps to reduce exposure include:
- Restrict management and SSL VPN interfaces from direct internet access wherever possible, placing them behind a VPN or allowlist instead.
- Apply the latest Fortinet security updates and firmware for your FortiGate devices without delay.
- Audit administrator accounts for unexpected additions or changed credentials.
- Enable multi-factor authentication for all administrative access.
- Review logs for signs of tampering, such as altered configs or unexplained login activity.
Given that lockouts are the reported outcome, having offline backups of device configurations and a tested recovery plan is worth prioritizing. If you suspect a device has already been compromised, isolating it from the network before attempting remediation helps prevent further unauthorized changes.
Source: Unknown
Has anyone here already reviewed their FortiGate admin access and MFA settings in response to this warning?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login