TL;DR: FortiBleed exposed a structural flaw in internet-facing remote access: roughly half of Fortinet firewalls had credentials harvested, with attackers reusing leaked passwords, cracking weak hashes, and pivoting into internal networks, according to Appgate. Patch cycles did not matter because the gateway itself was the target, not a software flaw.
At a glance
What this is: FortiBleed is a credential-harvesting campaign against internet-facing Fortinet gateways that exposed the weakness of perimeter access models rather than a new software flaw.
Why it matters: It matters because IAM and PAM teams cannot treat exposed remote access as a patch problem; they have to govern gateway exposure, credential reuse, and post-login reach as an identity design issue.
Context
FortiBleed is a perimeter access failure, not a product vulnerability story. The article describes internet-facing Fortinet gateways that could be reached, scanned, and credential-stuffed because the access model itself exposed a public target. For IAM and NHI practitioners, the important question is not whether software was patched, but whether the architecture still assumes that a reachable gateway plus a valid credential is enough to grant broad access.
The central governance gap is that remote access gateways often turn identity proof into network reach. Once a login succeeds, the session can inherit more access than the task requires, which makes credential theft disproportionately powerful. That is why this article sits at the intersection of identity governance, remote access design, and privileged access containment.
Key questions
Q: What breaks when a VPN gateway is exposed to the public internet?
A: A public VPN gateway turns identity into attack surface. It can be scanned, brute-forced, and credential-stuffed at scale, so the first control failure is not patching but discoverability. Once the gateway is reachable, a valid credential can become a network foothold instead of a narrowly scoped login.
Q: Why do leaked VPN credentials still create lateral movement risk?
A: Leaked credentials remain dangerous because many gateways still translate a successful login into broad network trust. If the session lands inside the internal network with more reach than the task requires, the attacker can pivot from authentication to discovery and movement without needing another exploit.
Q: What do security teams get wrong about patching remote access appliances?
A: They often treat patching as if it solves the risk on its own. In a perimeter model, the real issue is that the gateway stays public and continues to accept credentials. If the architecture still presents a reachable target, patched software can still be used as an entry point.
Q: Should organisations replace wide VPN access with application-scoped remote access?
A: Yes. Wide VPN access assumes that a user should inherit network adjacency after a single login, which is exactly what attackers exploit after credential theft. Application-scoped access reduces blast radius by limiting what a stolen credential can reach and by keeping unnecessary network paths closed.
Technical breakdown
Why internet-facing VPN gateways become credential targets
A VPN or SSL VPN gateway must be reachable from the public internet, which means it can be scanned, sprayed, and brute-forced at scale. That reachability changes the attack economics: attackers do not need to defeat a hidden internal control, they only need a valid credential path into a device that is designed to answer connection attempts. The problem is architectural. When the gateway is the security boundary, every exposed endpoint becomes a credential collection point and every successful login can become a launch point into the network.
Practical implication: treat public gateway exposure as an identity-design decision, not just a network setting.
Why leaked credentials still work against perimeter access
FortiBleed shows how attackers reuse credentials from earlier breaches, crack weak password storage, and abuse exported configuration files to recover legacy hashes. That combination turns old identity debt into current compromise potential. If multi-factor authentication is absent and password handling is weak, a stolen or recovered credential is not just a login secret, it is a reusable network key. In identity terms, the control failure is not only credential theft, but the lack of compensating controls that prevent a credential from becoming broad session authority.
Practical implication: govern credential lifecycle and authentication strength as one control surface, not two separate projects.
How post-login reach turns authentication into lateral movement
A successful VPN login often opens access to a much larger network segment than the user needs. That is why gateway compromise so often becomes internal pivoting rather than a single-account incident. In FortiBleed, attackers used cracked gateway access to move into internal Active Directory environments. This is the classic failure of excessive session reach: the identity proves itself once, then inherits trust that extends beyond the task, allowing the attacker to search, enumerate, and move laterally with little resistance.
Practical implication: scope remote access to specific applications and services, not to general network adjacency.
Threat narrative
Attacker objective: The attacker objective was to turn harvested VPN credentials into reusable internal access that could pivot into enterprise networks.
- Entry occurred through exposed internet-facing Fortinet firewalls and SSL VPN gateways that accepted attacker reachability and credential attempts.
- Credential access came from reused passwords, brute force against weak password storage, and cracking of legacy hashes exported from configuration files.
- Escalation followed when valid gateway access was reused to enter internal environments, including Active Directory-connected networks.
- Impact was internal foothold creation across many devices, giving attackers a path to broader network compromise and reuse of the stolen credentials at scale.
Breaches seen in the wild
- Commvault Metallic breach 2025: A nation-state actor exploited a Commvault zero-day in Azure and may have taken app secrets that open customers' Microsoft 365 tenants.
- Hugging Face Spaces breach 2024: Unauthorised access to Hugging Face Spaces may have exposed secrets users stored for AI apps; tokens were revoked and org tokens removed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
The perimeter access model is the failure, not the patch cycle. FortiBleed demonstrates that a discoverable gateway on the public internet is itself an identity risk surface. The article makes clear that attackers did not need a new exploit because the system trusted a valid login too much and exposed too much once authenticated. For practitioners, the governing assumption that must be challenged is that patching can compensate for a reachable authentication boundary.
Gateway reachability creates identity blast radius. When a remote access device answers anyone on the internet, the blast radius is measured in credential exposure, not just device compromise. A single harvested credential can translate into broad internal reach, especially where the gateway hands out network-level access instead of task-level access. That is why perimeter access design belongs in identity governance, not only in network operations.
Credential reuse is not an edge case here, it is the business model of the attack. FortiBleed shows how old breaches, weak hash protection, and missing MFA combine into a reusable identity asset for attackers. The lesson for NHI and IAM teams is that identity assurance fails when credentials remain valid across too many environments and too many sessions. The practitioner implication is to stop treating leaked credentials as isolated events and start treating them as architectural debt.
Perimeter trust and Zero Trust cannot coexist at the gateway boundary. The article’s core contrast is between a model that authenticates once and exposes a network, and a model that verifies continuously and exposes only what is needed. That makes the gateway a governance decision point, not a technical convenience. Teams that still depend on wide network reach after login are preserving the exact condition FortiBleed exploits.
FortiBleed names a repeatable category, not a vendor-specific exception. The same playbook was reportedly used against other gateways and infrastructure targets, which means the pattern is broader than one firewall family. The field implication is that identity security teams should evaluate perimeter access as a class of exposure, with control design focused on removing discoverable attack surfaces and narrowing post-login scope.
What this signals
Identity blast radius is the right lens for perimeter access. FortiBleed shows that the real governance problem is not whether a gateway can authenticate users, but how far a credential can reach once it succeeds. IAM and PAM programmes should measure remote access by the damage a stolen login can do, not by whether the login path still works.
Publicly reachable access boundaries need to be treated as high-risk identity assets. When a remote access appliance is on the internet, it becomes part of the organisation’s identity attack surface. That shifts control priority from patch cadence to exposure reduction, MFA enforcement, and session scoping.
Perimeter trust is increasingly incompatible with modern identity governance. The more a login path behaves like a general network key, the more it undermines least privilege and Zero Trust goals. Practitioners should assume that every public gateway needs to justify its existence, not just its configuration.
For practitioners
- Audit exposed gateway reachability Inventory every internet-facing VPN, SSL VPN, and management endpoint, then decide whether each one is still justified as a public target. If the answer is no, remove public exposure rather than compensating with more monitoring.
- Enforce MFA on all remote access Require multi-factor authentication for every external login path, including administrative access and legacy remote access flows. Treat any remote access that still relies on passwords alone as a priority remediation item.
- Rotate and invalidate reused credentials Reset administrative and VPN credentials that may have been harvested, and invalidate any exported or legacy password material that can still be replayed. Focus on credentials that were reused across incidents or stored in configuration exports.
- Replace network-level trust with scoped access Limit remote sessions to specific applications and services instead of exposing broad internal network reach after authentication. Narrowing the post-login blast radius is the control that breaks lateral movement.
- Remove management interfaces from public exposure Move management surfaces off the public internet and confirm that remote administration depends on stronger boundary controls than a reachable credential prompt. Public management exposure turns identity compromise into infrastructure compromise.
Key takeaways
- FortiBleed illustrates a structural remote access failure: a public gateway plus a reusable credential created the attack path, not a new exploit.
- The article says roughly half of internet-facing Fortinet firewalls had credentials harvested, which shows how quickly exposed access models can be operationalised by attackers.
- The control that changes the outcome is not only patching but reducing public gateway exposure, tightening authentication, and scoping sessions to the smallest possible access boundary.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on credential reuse, weak password storage, and absent MFA at exposed gateways. |
| NHI-05 — Overprivileged NHI | The article shows how VPN sessions grant broader network reach than the task requires. | |
| NHI-07 — Long-Lived Secrets | The harvested credentials and legacy hashes remained reusable long enough to be weaponised at scale. | |
| Recommendation — Enforce stronger authentication on remote access paths and eliminate password-only login for exposed gateways. Reduce remote access scope so a successful login cannot open broad internal network reach. Shorten credential validity and invalidate any reusable remote access secrets that outlive their intended use. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential lifecycle and reset discipline are central to the campaign described in the article. |
| Recommendation — Apply authenticator management controls to rotate, revoke, and invalidate compromised remote access credentials. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes credential harvesting followed by internal pivoting into enterprise networks. |
| Recommendation — Map exposed-gateway incidents to credential access and lateral movement to prioritise containment and hunting. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture — Zero Trust Architecture | The article directly contrasts perimeter trust with continuous verification and scoped access. |
| Recommendation — Replace network-level trust with continuously verified, resource-scoped access paths. | ||
Key terms
- Perimeter access model: A perimeter access model is a design that exposes a login point on the public internet and then trusts the authenticated session to carry users into the internal network. In identity terms, it concentrates risk at one reachable control and often grants more reach than the task requires.
- Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
- Credential Harvesting: Credential harvesting is the collection of secrets, tokens, keys, or certificates from a compromised workload. In container environments, it often targets file paths, environment variables, service account tokens, and metadata services because those locations frequently hold reusable identity material.
- Context Scope: Context scope is the set of information an AI agent is allowed to see before it acts. It is an important control because overly broad context can expose sensitive code or data, while overly narrow context can cause bad decisions. Governance should treat context scope as a privileged boundary.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 22, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org