Topic starter
04/07/2026 9:57 pm
TL;DR: FortiBleed shows how attackers can exploit internet-facing FortiGate and FortiClient EMS exposure to harvest credentials at scale, gain admin access on 409 targets, and drive ransomware activity, according to Orca Security. The incident shows that patching alone is not enough when credential interception, standing privilege, and unmanaged admin accounts remain in place.
Editorial analysis by NHI Mgmt Group, based on content published by Orca Security: “FortiBleed Campaign Harvests 110M+ Credentials, Fuels Ransomware Operations”.
By the numbers:
- Attackers gained admin-level access on 409 targets.
- CVE-2026-35616 has a CVSS score of 9.1.
Key questions
Q: What breaks when FortiGate credentials can be harvested passively?
A: Passive capture breaks the assumption that credentials are only exposed at login time.
Q: Why do internet-facing control planes create such a large identity and security risk?
A: They concentrate privilege, configuration authority, and secrets in one reachable place.
Q: How can security teams tell whether Fortinet exposure is being abused?
A: Look for unexplained admin account activity, unexpected packet-sniffer behaviour, abnormal EMS configuration changes, and indicators tied to the reported FortigateSniffer tooling.
Practitioner guidance
- Rotate all Fortinet-related credentials immediately Reset VPN, RADIUS, NTLM, Kerberos, and administrative credentials on FortiGate-managed infrastructure, and treat each as potentially observed in transit rather than only stolen from a host.
- Restrict exposure of EMS management access Limit FortiClient EMS port 8013 to trusted IP ranges and review whether any administrative endpoint is reachable from untrusted networks.
- Remove and hunt for unauthorised admin accounts Audit FortiGate administrative accounts for the reported adminin backdoor account and any other unexpected privileged identities.
Bottom line: FortiBleed is best understood as a credential-harvesting campaign against Fortinet trust infrastructure, not as a single-device vulnerability story.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/07/2026 10:03 pm
FortiBleed is a trust-model failure, not just a vulnerability story: the breach path matters because attackers used exposed Fortinet infrastructure to turn management traffic into credential harvest. The practical lesson is that remote access and management planes are identity systems in their own right, so their exposure has to be governed as such. Organisations that treat this as a patch-only event will miss the real control failure.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do immediately after a FortiClient EMS compromise?
A: Contain the management plane, rotate all credentials that may have traversed it, and validate administrative account integrity before re-enabling normal access. The key question is whether the attacker could have modified remote access profiles or injected scripts, because that changes the response from patching to full identity reset.
👉 Read our full editorial: FortiBleed shows why credential harvesting breaks Fortinet trust models