FBI Alerts That FortiBleed Exploits Remain Active, Over 86,000 FortiGate Units Compromised

The Federal Bureau of Investigation has issued a fresh warning that the FortiBleed intrusion campaign targeting Fortinet's FortiGate firewalls remains ongoing, with more than 86,600 devices reported as compromised.

According to threat‑monitoring firm SOCRadar, the malicious activity has been detected on 86,644 FortiGate units spread across 194 distinct locations worldwide. The scale of the breach underscores the persistence of the exploit, which leverages a vulnerability in the firewall's handling of certain network traffic.

FortiGate appliances are widely deployed by enterprises, service providers, and government agencies to protect perimeter networks. When attackers gain access to the management interface, they can bypass security controls, exfiltrate data, or use the device as a launch point for further attacks.

The FBI’s advisory follows earlier disclosures that the FortiBleed vulnerability was first publicly disclosed in early 2024. Since then, multiple security researchers have documented active exploitation, prompting Fortinet to release patches and mitigation guidance. However, SOCRadar’s latest figures suggest many organizations have not yet applied the updates or have configurations that remain vulnerable.

Cyber‑security experts emphasize that remediation requires more than a simple software update. Administrators are urged to verify that default credentials have been changed, to enforce strict access controls, and to monitor logs for anomalous activity that may indicate a breach.

Fortinet has reiterated its commitment to addressing the issue, urging customers to download the latest firmware and to follow its hardening recommendations. The company also offers a free tool that scans for signs of compromise on FortiGate devices.

Law‑enforcement agencies, including the FBI, are reportedly working with affected organizations to assess the impact and to gather intelligence on the threat actors behind FortiBleed. The agency has not disclosed the identity of the groups responsible, but past analyses have linked similar campaigns to financially motivated cybercriminals operating out of Eastern Europe and Asia.

Stakeholders are advised to treat the advisory as a high‑priority alert. Continued exploitation could lead to broader network infiltration, data theft, or service disruption, especially in sectors that rely heavily on FortiGate firewalls for critical infrastructure protection.