CISA Urges Hardening Fortinet Devices After Reports of Credential Exposure
2026-06-18T23:24:10Z•de45fffbd7dded15120bbfb745d1909d9e5ac22ca04d3789cfb3d22ce426476f
Arista EOS","Chromium V8BOD 22-01BOD 26-04Cisco SD-WANFortiBleedFortiGateFortinetIvanti SentryJoomlaKEV CatalogKnown Exploited VulnerabilitiesLiteSpeedOracle PeopleSoftPBKDF2SSL VPNSplunkcPanelcredential exposurelateral movementleaked credentialslog reviewmultifactor authenticationpatchingphishing-resistant MFAvulnerability management
What happened
CISA reports a global credential exposure impacting ~74,000 internet-accessible Fortinet devices (FortiGate firewalls and SSL VPN gateways) — dubbed ‘FortiBleed’ — and urges immediate remediation: terminate active SSL VPN/admin sessions, reset passwords, enforce PBKDF2 for admin credential storage, enable phishing‑resistant MFA on remote/admin accounts, and review logs for lateral movement or unauthorized changes. In addition, CISA added multiple actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and directs organizations to prioritize rapid remediation and
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- cisa_ncas_current_activity
- Record identifier
- de45fffbd7dded15120bbfb745d1909d9e5ac22ca04d3789cfb3d22ce426476f
- Enrichment time
- 2026-06-18T23:24:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.