FortiBleed Turns Access Into Ransomware Risk
US agencies describe FortiBleed as an active credential campaign against internet-facing FortiGate firewalls and SSL VPN gateways. Reported outcomes include administrator lockouts and brokered access for INC/Lynx and Payload ransomware affiliates.
This is a credential-compromise warning, not a new zero-day or patch bulletin. No FortiBleed CVE or fixed-build matrix is identified.
Investigate before eviction
The advisory places evidence collection and scoping between isolation and eviction.
Review accounts, sessions, configuration and the wider environment as one incident.
Update software and accounts
Fortinet recommends supported current 7.4, 7.6 or 8.0 releases alongside session termination, credential resets, MFA and configuration review. These are hardening steps, not a FortiBleed version matrix.
Fortinet says existing administrator accounts keep SHA-256 storage until that account logs in successfully or a super administrator resets its password. Weaker legacy hashes can be removed with the applicable lockout policy.
Fortinet warns that, after legacy hashes are removed, downgrading to firmware without PBKDF2 support can lock administrators out if no administrator account remains that has never logged in to generate a PBKDF2 hash.
Software support for stronger storage and completed account migration are separate facts.
Use live evidence
The listed network indicators were observed from 18 June to 23 July 2026. Cloud-hosted addresses can be reassigned, so check current telemetry before blocking.
Sources: FBI-USSS joint advisory; Fortinet incident analysis; and Fortinet PBKDF2 guidance.
