FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices

This Qualys blog feed centers on active risk from credential abuse (not a novel zero-day) and the accelerating threat landscape driven by AI. The lead item, “FortiBleed,” describes June 2026 reporting of large-scale credential exposure and abuse targeting internet-reachable FortiGate management and SSL‑VPN gateways — attacks driven by credential reuse and brute‑force. Risk is highest for internet‑exposed FortiGate devices without MFA, with reused or legacy‑hashed credentials, or with prior exposure to known‑exploited Fortinet vulnerabilities. Recommended mitigations include enforcing MFA, rem­