FortiBleed: Firewalls24.de Publishes Guide to Immediate Action for Fortinet Administrators

In mid-June 2026, a comprehensive dataset containing valid login credentials for internet-exposed Fortinet firewalls was made public under the name FortiBleed. Firewalls24.de, the German online store and specialist portal for IT security solutions operated by Aphos GmbH, has published a detailed guide on the matter that analyzes the facts and summarizes specific immediate actions for administrators.

Not a New Zero-Day, but Known Vulnerabilities

According to analyses by security researchers Hudson Rock, SOCRadar, and Kevin Beaumont, the dataset includes between 30,000 and 75,000 affected devices in 194 countries, depending on the methodology used. Contrary to what the name might suggest, based on current information, this is not a new zero-day vulnerability, but rather a combination of known vulnerabilities, outdated password hashes, and reused credentials from previous data breaches and infostealer logs.

German Devices Affected Aswell

Devices in Germany are also affected. An analysis by heise online identifies over 120 systems with domains in Germany. The BSI and CERT-Bund have long pointed out that administrative access points on firewalls--across all manufacturers--are too often openly accessible from the internet. At the time of publication, German authorities had not issued their own FortiBleed warning.

Four Immediate Steps for Fortinet Administrators

Firewalls24 recommends four key steps for operators of Fortinet devices: Update FortiOS and associated components to the latest patches, remove management interfaces from the internet, perform a forced password reset after the update to switch to the more secure PBKDF2 algorithm, and enable multi-factor authentication for all external access points.

The complete checklist, including indicators of compromise, is available in the detailed FortiBleed guide at Firewalls24.de

"The devices that are now appearing in such datasets are almost always the ones that nobody pays attention to in day-to-day operations. Keeping systems up-to-date with the latest patches, securing management access, and enforcing password changes are not one-time projects but ongoing operations," says Roman Jacobi, Managing Director of Aphos. "Incidents of this kind can, in principle, affect any manufacturer. What matters is operational discipline, not the brand."

Managed Firewalls and Service Level Agreements

For organizations that cannot permanently handle patching, monitoring, and hardening of their firewalls in-house, Aphos GmbH offers managed firewalls as part of firewall service level agreements. These agreements specify binding response and patching times, ensuring that updates, the closure of management access points, as well as regular configuration checks and password rotations are reliably carried out during normal operations.

Aphos Gesellschaft fuer IT-Sicherheit mbH
Mergenthalerallee 73-75
Eschborn 65760
Germany

https://aphos.de/

Herr Lennart Wyrwa
061965820160

marketing@aphos.de

Aphos Gesellschaft fuer IT-Sicherheit mbH is a specialized IT security service provider focused on tailored cybersecurity solutions for businesses, government agencies, and public institutions. As a fully technically accredited Sophos Platinum Partner and a partner of CrowdStrike and Fortinet, the company offers first-class consulting, comprehensive support, and a broad portfolio of IT security solutions.

With Firewalls24.de, the online store for Sophos IT security solutions, Aphos GmbH enables quick and easy procurement of Sophos firewalls, switches, access points, and Sophos Central licenses.

Thanks to its combination of technical expertise, personalized consulting, and competitive pricing, Aphos is the ideal partner for companies of all sizes that prioritize the highest security standards.

This release was published on openPR.