The question
What we told them
Yes. And no patch fixes it, because this is not a software bug. The attackers are logging in.
FortiBleed is a campaign against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. Per the joint FBI and Secret Service advisory of 7 Oct 2026, attackers take passwords stolen elsewhere, from earlier leaks and infostealer logs, and try them against firewall logins. The advisory cites more than 86,644 compromised devices in 194 countries. The access is then offered to ransomware affiliates tied to the INC/Lynx and Payload groups.
The lockout is the part that should worry you. Once inside, attackers can delete or change the original admin passwords and create accounts the owner has never seen. Some victims could no longer sign in to their own firewall. The reporting says recovery may need steps beyond standard patching and password resets.
For a business with 25 people, the firewall is the front door, and its admin and VPN logins are usually the most powerful accounts you own. Many small offices still have one shared admin login from the day of install, a management page reachable from the internet, and no second factor. Any brand of firewall with that setup has the same problem.
Here is what we would do first. Close the management page to the internet. Make every admin and VPN login prove itself with phishing-resistant MFA. List every account on the device and delete anyone nobody can name. Then reset the passwords.
Our opinion: a firewall that anyone on the internet can try to sign in to is not a setting. It is a decision, and most small businesses never made it on purpose.
Patching will not save a firewall whose login can be guessed with stolen passwords. This week, ask your IT provider three things in writing: is the admin page reachable from the internet, does every admin and VPN login need MFA, and who reviewed the account list last.