Two separate Fortinet stories ran this year and they point at the same thing. One is a five-year-old bug getting attacked again. The other is a credential leak where patching your firewall didn’t actually fix it.
FortiBleed
In mid-June, researchers flagged an active campaign pulling configuration files off internet-facing FortiGate firewalls and cracking the credential hashes inside them. Arctic Wolf put the result at verified working credentials for somewhere between 30,000 and 75,000 devices, across 194 countries. That’s roughly half of all internet-facing Fortinet firewalls.
The mechanism is the part worth understanding. Older FortiOS stored administrator passwords in the config using a SHA-256 scheme. FortiOS 7.2.11 moved to PBKDF2, which is meaningfully harder to crack. But upgrading didn’t rewrite the stored hash. The legacy SHA-256 hash stays in the config until an administrator actually logs in again.
So a shop that patched promptly, felt good about it, and didn’t happen to log in with that admin account still had the old crackable hash sitting in a config file that had already been exfiltrated. Patched and still exposed, with nothing in the upgrade telling you so.
The five-year-old one
Separately, CVE-2020-12812 came back around. It’s an improper authentication flaw in FortiOS SSL VPN, originally disclosed in July 2020, that lets someone bypass the second factor entirely under certain LDAP authentication configurations. Shadowserver counted more than 10,000 Fortinet firewalls still unpatched against it.
A 2020 CVE with a patch available for years is not an interesting vulnerability. It’s interesting that thousands of production firewalls are still running it in 2026.
Where we land
Same conclusion we landed on in the QNAP guide, for the same reason. The thing that turns a vulnerability into an incident is usually that the management or VPN interface was reachable from the open internet in the first place.
None of this means Fortinet gear is bad. Plenty of it is doing serious work in serious places. But an SSL VPN listening on a public IP is a login prompt the entire internet can see, and it stays that way between the day a CVE drops and the day you get around to patching.
The FortiBleed detail is the one worth taking somewhere else with you, though. “We patched” and “we’re not exposed” are different claims. Sometimes the fix needs a step the upgrade didn’t do for you, and nothing warns you that you’re still holding the old problem.
Sources: Arctic Wolf on the FortiBleed campaign, Cybersecurity Dive on renewed CVE-2020-12812 exploitation.