FortiBleed Advisory: What Businesses Should Check Now

On October 6, 2026, the FBI and U.S. Secret Service published a joint advisory about FortiBleed, an ongoing credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways.

The agencies describe stolen or reused credentials, unauthorized administrator accounts, possible lockouts, and access supplied to ransomware affiliates. The alert is a reason to verify your environment, not proof that every FortiGate installation is compromised.

Read the original FBI/USSS advisory, JCSA-20261006-01. This article translates the issue into practical questions for a small business and its technology provider.

Why this matters to a small business

Your firewall and remote-access gateway can sit between the office, remote employees, and essential applications. For a business that depends on them, disruption could affect access to files, vendor systems, customer service, or support tools.

Those are potential operational effects, not findings about any SMART Solutions customer. The impact depends on your actual network and business workflows.

Start with the network documentation checklist: which equipment is installed, who manages it, what is externally reachable, and what work depends on it?

First, confirm whether the advisory applies

Ask your IT provider or administrator to identify:

• Whether any FortiGate devices or SSL VPN gateways are in use
• Which models, software versions, and support arrangements apply
• Which administrative and remote-access interfaces are internet-facing
• Who owns the device configuration and can authorize changes
• Which users, vendors, and business workflows depend on remote access

Include equipment maintained by an outside provider. A business owner may not recognize the vendor name even when that equipment supports daily operations.

If no relevant Fortinet equipment is present, record that finding. General remote-access reviews can still be useful, but this advisory should not be presented as evidence of a compromise involving an unrelated product.

A firmware update is not the complete answer

Fortinet’s June 19 analysis describes the reported activity as credential reuse and brute-force activity, rather than a new vulnerability.

Its recommended response includes ending administrative and VPN sessions, resetting credentials, enforcing MFA, restricting management access, reviewing accounts and configuration, and examining logs. The vendor directs organizations with evidence of unauthorized changes to its compromise-recovery guidance.

Have the administrator use the guidance appropriate to the installed product and version. Avoid treating a successful update as confirmation that access, accounts, and configuration are trustworthy.

Our firewall management guide connects those checks with ordinary change control and documentation.

Request a coordinated access review

Assign one technical owner to coordinate the work and explain the result in business terms.

Ask how session termination, credential changes, account verification, and vendor access will be handled without leaving staff unsure how to reconnect. Record the approved maintenance window and the fallback communication route.

Require stronger authentication appropriate to the supported platform. The phishing-resistant MFA guide explains the broader access-control goal; implementation must be verified for the actual gateway.

Also ask the administrator to review API-based integrations and their owners. Configuration backups, monitoring, and automation should have documented access rather than unexplained credentials. Changes to those integrations need a coordinated test.

Use the vendor access checklist to identify support accounts and remote paths that remain necessary.

Verify administrator password storage carefully

Fortinet’s PBKDF2 technical guidance explains that upgrading can leave administrator passwords in the older format until migration occurs. It also describes retained legacy password settings and version-dependent controls for removing them.

The guidance warns about administrative lockout after a downgrade to software that does not support the safer password format.

This is work for the responsible administrator with a recovery plan. Ask for confirmation that applicable credential-storage requirements have been checked, not for a business user to paste a command into production equipment.

Review evidence before declaring the system clean

Have the technical team explain what it reviewed and what remains uncertain. A useful report should identify the device, review period, available logs, account changes, configuration comparisons, and unresolved findings.

The advisory supplies observed IP addresses and account names. It cautions that historical IP indicators require corroboration before defensive action. Use the original document with current telemetry rather than treating a copied list as a permanent verdict.

For business review, request a clear conclusion: no relevant equipment found, checks completed without identified evidence in the reviewed scope, or suspicious activity requiring incident response. Keep limitations explicit.

A missing historical log is a gap to record. It should not silently become a statement that nothing happened.

If suspicious activity is found, use the incident plan

Escalate promptly to your designated response team. Have it coordinate containment, evidence preservation, scope assessment, recovery, and the appropriate reporting decisions.

Follow the small-business incident response plan rather than asking employees to reset or rebuild equipment on their own.

The joint advisory provides incident-response and agency reporting instructions. Keep that official reference with the technical response record.

For business continuity, identify the essential workflows and approved temporary arrangements. Use your RTO/RPO objectives and backup recovery tests to assess what the team can actually restore.

What to request from your technology provider today

• A device and exposure inventory relevant to this advisory
• A named owner for the technical review and any maintenance
• Evidence that applicable account, access, configuration, and credential-storage checks were performed
• A documented conclusion, including missing evidence or unresolved issues
• A tested recovery and communication plan for disruptive changes
• An escalation decision if suspicious activity is identified

Set a review deadline based on the environment’s exposure and the technical team’s assessment. Avoid substituting a generic checklist score for an actual investigation.

FortiBleed advisory FAQ

Does the alert mean every business using Fortinet is compromised?

No. Verify applicability and have the responsible team investigate the relevant evidence. This article does not identify a compromise in your environment.

Should employees change firewall settings themselves?

No. Coordinate changes through the authorized administrator and the incident or maintenance process.

Can SMART Solutions help review the environment?

SMART Solutions provides network security assessments and cybersecurity planning, with practical recommendations based on the environment. Contact our team to review the applicable scope and next steps.

Primary references

• FBI and U.S. Secret Service — October 6, 2026 FortiBleed advisory
• Fortinet — Analysis of reported credential compromise
• Fortinet — Administrator password hashing and legacy settings

The useful outcome is a documented assessment and an assigned response. Start by confirming the equipment and exposure, then act on what the authorized technical review finds.