NCSC Alert: Fortinet Firewall/VPN Credential Breach via Brute Force

Vulnerability Overview NCSC (National Cyber Security Centre) has issued an alert indicating that Fortinet firewalls and VPN gateways are under attack globally. Attackers have leaked credential databases from internet-facing FortiGate and VPN portals using brute-force, dictionary, and credential-stuffing attacks. Scope of Impact Affected products: Organizations using Fortinet products, particularly those with Fortinet edge devices that have SSL VPN enabled. Potential impact: Attackers may exploit leaked credentials to access other services, resulting in unauthorized data access and system control. Remediation Steps 1. Check the FortiBleed Checker: Use Hudson Rock’s FortiBleed Checker to identify domains not included in the early warning asset list. 2. Confirm device ownership: Verify whether the device exists and is owned by your organization. 3. Determine if the device is compromised: Look for common Indicators of Compromise (IoCs), such as unauthorized account creation and anomalous activity in log files, to assess whether the Fortinet device has been compromised. 4. Isolate the device: If evidence of compromise is found, isolate the device from both the internet and the internal network. 5. Report the compromise: If you believe your systems have been compromised, report it to the NCSC and consider engaging a certified cybersecurity incident response provider. 6. Perform a factory reset: Changing credentials may not be sufficient to mitigate the threat. Perform a factory reset while preserving logs, configurations, and other useful information. 7. Investigate other devices: Investigate other edge devices that share credentials with the compromised device. 8. Monitor firewall logs: Investigate systems accessible via the compromised device and monitor firewall logs to ensure no further compromises occur. 9. Secure the reconfigured system: - Ensure the management interface is not exposed to the internet. - Update to the latest version. - Decommission the system from production as soon as possible. - Change all default, generic, or reused administrator passwords. - Enable Multi-Factor Authentication (MFA) for all VPN and device management logins. - Enable PBKDF2 for the admin interface and force all administrators to log in again. Further Recommendations and Resources Multi-Factor Authentication: Implement strong MFA methods to access enterprise online services. Prevent Lateral Movement: Guidance on preventing lateral movement within the enterprise network. Related Topics Cyber Threats Security Monitoring Additional Information Actions to Strengthen Network Security: Steps to improve security when an organization faces heightened threats. Penetration Testing: How to maximize the benefits of penetration testing. Speech by Richard Horne at the RUSI Annual Security Lecture: The full speech delivered by NCSC CEO Richard Horne at the 2026 RUSI Annual Security Lecture. Summary This alert highlights the global threat facing Fortinet firewalls and VPN gateways, providing detailed remediation steps and recommendations to help organizations detect and prevent cyberattacks.

Goal Reached Thanks to every supporter — we hit 100%!

NCSC Alert: Fortinet Firewall/VPN Credential Breach via Brute Force