Analysis of Reported Credential Compromise of FortiGate Devices

Fortinet PSIRT blog posts provide multiple analyses of observed abuse and compromises affecting FortiGate/FortiOS devices, including reported credential compromise (referred to as “FortiBleed”), single sign‑on (SSO) abuse, and post‑exploitation techniques. Fortinet documents threat actor activity such as public postings claiming compromised device configurations and VPN credentials, observed exploitation of N‑day vulnerabilities (notably CVE-2023-27997) and abuse related to advisory FG-IR-19-283, and publishes IoCs and mitigation guidance to help customers confirm impact and remediate (patch/h