CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure

CISA warns of widespread credential exposure impacting internet-facing Fortinet devices ("FortiBleed"), reporting leaked credentials associated with ~74,000 FortiGate appliances and SSL VPN gateways. CISA urges impacted customers to immediately terminate active SSL VPN/administrative sessions, reset VPN and admin passwords, enforce strong password policies, ensure administrator credential hashes use PBKDF2 (remove legacy weak hashes per Fortinet guidance), review firewall/VPN/authentication/domain controller logs for lateral movement or unauthorized changes, and enable phishing-resistant MFA.