Summary
The FBI has issued a warning about an ongoing attack campaign dubbed FortiBleed targeting Fortinet FortiGate VPN devices, in which attackers are harvesting administrator credentials from device memory and using those credentials to lock legitimate administrators out of their own FortiGate devices. FortiBleed is a distinct attack vector from the FortiMail zero-day CVE-2026-47575 documented in TTO-2026-1004-191, affecting a different Fortinet product line and exploiting a different vulnerability class. Organizations running FortiGate VPN appliances should immediately audit administrator account activity and review device configurations for unauthorized changes.
Timeline
| Date | Event |
|---|---|
| Oct 4, 2026 | Fortinet FortiMail CVE-2026-47575 zero-day documented; TTO-2026-1004-191 published |
| Oct 8, 2026 | FBI issues FortiBleed warning; ongoing credential harvesting and admin lockout attacks on FortiGate VPN; BleepingComputer reports |
What Happened
FortiBleed exploits a memory exposure vulnerability in FortiGate VPN devices that allows attackers to read sensitive data from device memory, including administrator session tokens and credentials. Once administrator credentials are harvested, attackers use them to authenticate to the FortiGate management interface, modify device configurations, create backdoor administrator accounts, and then change or disable the legitimate administrator’s credentials — locking the organization out of their own VPN appliance. The admin lockout is both an indicator of compromise and a denial-of-service impact that can prevent an organization from managing or reconfiguring their network perimeter.
The FBI’s warning characterizes the campaign as ongoing and widespread, indicating that a significant number of FortiGate deployments have already been compromised. September and October 2026 have seen an unprecedented concentration of critical vulnerabilities across Fortinet’s product portfolio — FortiMail (CVE-2026-47575), and now FortiGate VPN (FortiBleed) — alongside the broader pattern of network infrastructure zero-days documented across Citrix NetScaler, Cisco SD-WAN, Arista VeloCloud, and F5 BIG-IP. Organizations should treat any FortiGate device showing unexpected administrator account changes or configuration modifications as potentially compromised and initiate incident response procedures.
Domain Intelligence
fortinet.com — 88.0
fortinet.com scores at 88.0 in the high-trust range. Score unchanged from TTO-2026-1004-191. Fortinet is the vendor of the affected FortiGate VPN product line.