Ep. 85 - FortiBleed: The Campaign With No CVE That Locks You Out of Your Own Firewall

The FBI and US Secret Service just dropped joint advisory JCSA 2026-1601 on FortiBleed—and there is no CVE to patch. Tova Dvorin and Adrian Culley walk the full chain: credential stuffing against internet-facing FortiGate SSL VPNs, legacy SHA-256 admin hashes cracked on rented GPUs, fake vendor-style admin accounts, and attackers deleting your accounts to lock you out of your own firewall. Plus the INC/Lynx ransomware link, what the 86,000 figure really means, and the question that matters: would a new admin on your edge device at 3am fire anything?

More info on FortiBleed, and SafeBreach coverage for it: https://www.safebreach.com/blog/fortibleed-fortigate-jcsa-20261006-01-safebreach-coverage/

TIMESTAMPS:

00:00 What is FortiBleed, and why did the FBI and Secret Service issue a joint advisory?

02:05 Why is there no CVE to patch for FortiBleed?

05:55 How does the FortiBleed attack chain work?

10:14 How do attackers lock you out of your own firewall?

11:29 Is FortiBleed linked to INC/Lynx ransomware?
Yes: the joint FBI and Secret Service advisory says access brokers using the FortiBleed attack chain have sold access to ransomware affiliates, including INC/Lynx.

15:27 What should FortiGate teams do first?

#cybersecurity #infosec #CISO #FortiBleed #Fortinet #ransomware #CTEM #CriticalInfrastructure