FortiBleed Checker
Did your FortiGate firewall or Fortinet SSL-VPN credentials show up in the FortiBleed leak? Type in a domain, IP, or CIDR and find out. The check is free, takes seconds, and we never keep what you searched for.
No account needed. We do not log your query, and you get an answer right away.
What is FortiBleed?
FortiBleed is the name researchers gave to a large-scale Fortinet credential-exposure campaign that came to light in June 2026. It is not one software bug with a patch you can apply.
Around the middle of June 2026, researchers came across a dataset of plaintext Fortinet and FortiGate VPN logins (usernames, emails, and passwords) paired with the device IPs they belong to. A threat actor had collected them and left them sitting on infrastructure they controlled. Public reporting put roughly 74,000 internet-facing FortiGate firewalls and SSL-VPN gateways in the set, and tens of thousands of those credentials were checked by outside parties and found to still work.
Fortinet has been clear that this is not a fresh vulnerability. The logins go back to passwords reused from older incidents, plus large-scale brute force aimed at weak passwords and boxes that never had MFA turned on. Several analysts also flag the way FortiOS used to store admin passwords with SHA-256. Fortinet switched to PBKDF2 in FortiOS 7.2.11, 7.4.8, and 7.6.1, but any password set before that upgrade keeps its weak hash until someone changes it.
The danger here is not abstract. One working FortiGate VPN credential is enough for an attacker to tunnel straight into a corporate network, no further exploit needed. And where whole configurations leaked, the internal IPs, firewall rules, certificates, and private keys went along for the ride, which is everything an intruder needs to map the network and move sideways. Patching fixes the weak hashing going forward. It does nothing to the credentials that are already public, and the only fix for those is to rotate them.
FortiBleed next to the Belsen Group FortiGate leak
People mix up FortiBleed (2026) with the Belsen Group FortiGate dump from January 2025 all the time. They are two different events with two different root causes, and this checker looks at both.
Which Fortinet products are affected?
FortiBleed comes down to credentials, not a single CVE, so the exposure does not line up with one FortiOS version. If a device is reachable from the internet and its logins got harvested or guessed, it is in scope.
- FortiGate firewalls exposed to the internet
- Fortinet SSL-VPN gateways
- Any FortiGate whose VPN or admin logins were harvested or brute-forced
Move FortiOS to 7.2.11, 7.4.8, or 7.6.1 (or newer) so password hashing shifts from the old SHA-256 scheme to PBKDF2. Keep one thing in mind: the patch does nothing to logins that already leaked. You still have to rotate those.
You showed up in the dataset. Now what?
If your domain or IP is in there, work on the assumption that the matching Fortinet logins belong to an attacker now. Go through the following in order.
Rotate every credential
Reset all admin passwords, every SSL-VPN and local-user password, IPsec pre-shared keys, SNMP communities, and API keys. Pull and replace any certificates and private keys that were exposed. Anything you leave untouched is, for practical purposes, public.
Kill active sessions
Drop every live VPN and admin session and force everyone to log in again, so stolen tokens and open tunnels stop working.
Patch outside your normal window
Bring FortiOS up to 7.2.11, 7.4.8, or 7.6.1 (or newer) to retire the old password-hashing scheme.
Pull admin off the public internet
Turn off HTTP and HTTPS admin access on WAN interfaces and lock management down to trusted hosts or a dedicated management VLAN.
Require phishing-resistant MFA
Put MFA on every admin and VPN account. A password by itself is no longer something you can lean on.
Audit your admin accounts
Go through every admin account and remove anything you did not set up yourself, watching especially for short random usernames or 'support' accounts nobody recognizes.
Go hunting for signs of intrusion
Check for logins from odd IPs, fresh SSL-VPN portals on unusual ports, local users that quietly landed in VPN groups, and config changes nobody can explain.
If something is off, assume the worst
Find even one sign of intrusion and treat the device as fully breached. Run a real incident response and lean toward rebuilding it rather than trusting the config that is on it.
Want a hand triaging what is exposed, or keeping watch on it across your whole fleet? The analysts at LeakSonar do this work.
Checking your FortiGate by hand
This lookup is a starting point, not the last word. Confirm things on the box itself by running the checks below, then go looking for signs that someone got in.
- 1Check which FortiOS build you are on and upgrade to 7.2.11, 7.4.8, or 7.6.1+ so admin passwords land in PBKDF2 rather than the old SHA-256 hash.
- 2Go through every administrator and SSL-VPN local user. Remove the accounts you did not create and force a password reset on the ones you keep.
- 3Switch off HTTP and HTTPS admin access on WAN interfaces and restrict management to trusted hosts or a dedicated VLAN.
- 4Require phishing-resistant MFA on every admin and VPN login.
- Logins from IP addresses you do not recognize, or impossible-travel patterns
- Fresh SSL-VPN portals answering on unusual ports
- Local users that recently appeared inside VPN groups
- Firewall policy or config changes nobody on the team can account for
Spot any of these and you should treat the device as compromised and kick off incident response without waiting.
Frequently asked questions
FortiBleed is a large-scale Fortinet credential-exposure campaign that surfaced in June 2026. VPN and admin logins for tens of thousands of FortiGate firewalls were harvested and passed around. This tool is free: give it a domain, an IP, or a CIDR range, and it tells you whether matching records sit in the leaked dataset.
Fortinet and FortiGate VPN logins in plaintext, meaning usernames, emails, and passwords, each paired with the IP of the device they came from. On the boxes where the full configuration leaked, internal IP addresses, firewall rules, certificates, and private keys came out too.
Neither. FortiBleed is a researcher nickname for a credential-leak campaign, and there is no CVE behind it. Fortinet ties it to passwords reused from earlier incidents and large-scale brute force against weak passwords and devices with no MFA, not to a new software bug.
You can give it a single domain (example.com), an IPv4 address (203.0.113.10), or a CIDR range (203.0.113.0/24). The tool matches what you typed against the leaked dataset and answers in seconds, with a breakdown of which kinds of service the records came from.
They are two different events. The Belsen Group dump from January 2025 put out full configurations and VPN passwords for about 15,000 FortiGate devices, collected through the 2022 zero-day CVE-2022-40684. FortiBleed from June 2026 is bigger, still going, and covers roughly 74,000 devices with no single CVE behind it. This tool searches both datasets.
FortiGate firewalls and Fortinet SSL-VPN gateways that face the internet. Since this is about credentials, it does not map to one FortiOS version. Fortinet shifted password hashing to PBKDF2 in FortiOS 7.2.11, 7.4.8, and 7.6.1, so treat those as the floor for upgrading.
Public reporting put roughly 74,000 FortiGate devices in the dataset, with tens of thousands of logins confirmed to still work, across about 194 countries. Those numbers are still moving as people keep digging into the campaign.
Work on the assumption the logins are already in attacker hands. Rotate every admin and VPN password, key, and certificate. Drop active sessions. Patch FortiOS to 7.2.11, 7.4.8, or 7.6.1 or newer. Pull the admin interface off the public internet. Turn on MFA. Then go hunting for signs of intrusion, and if you find any, run a full incident response.
Assume yes for anything you have not changed since it leaked. An attacker can use it as-is. Patching does not touch logins that are already out there. Rotating them is the only thing that does.
No. It was still running when it was disclosed in June 2026, and freshly compromised devices keep landing in the dataset as time goes on.
Mostly, but do not read too much into it. A clear result only means nothing matched in the dataset we search, and that dataset is partial and keeps growing, and logins leak through other channels anyway. Keep MFA on and keep rotating passwords either way.
It is free and there is no account to make. We use your query to run the check and nothing else, and we do not keep it. If you want the full record-by-record findings for a domain, we can share them once you confirm ownership with a company email.
Anyone running a FortiGate firewall or Fortinet SSL-VPN gateway that faces the internet. The risk climbs for shops still using old passwords, running without MFA, or leaving the admin interface reachable from outside.
Put your organization's domain or your FortiGate's public IP (or its range) into the tool above. If matching records come back from the FortiBleed dataset, rotate the affected logins right away and walk through the remediation steps.
Most tools only know about one of the two incidents. The LeakSonar checker queries both the 2026 FortiBleed credential leak and the 2025 Belsen Group configuration dump in one place, takes domain, IP, and CIDR input, and keeps none of your queries.
The next leak should not be the way you find out
A single check tells you about today. LeakSonar keeps watch on the dark web, breach dumps, and credential markets for anything tied to your organization, and it pings you the moment something turns up.