FBI and Secret Service Warn of Ongoing FortiBleed Lockout Threat
Federal agencies alert administrators that Fortinet systems remain under active targeting for lockout attacks via the FortiBleed vulnerability.
Key points
- The FBI and U.S. Secret Service have issued a warning regarding continued targeting of Fortinet administrators.
- Attackers are leveraging the FortiBleed vulnerability to execute account lockout attacks.
- Systems remain at risk as these targeted campaigns persist.
The Federal Bureau of Investigation and the U.S. Secret Service have issued a new alert warning that Fortinet administrators are still under active attack. According to Infosecurity Magazine, federal law enforcement agencies are cautioning organizations that their Fortigate systems continue to be targeted by threat actors exploiting the FortiBleed vulnerability to cause account lockouts.
The primary concern highlighted in the warning is the persistence of these attacks. Rather than a new discovery, the alert serves as a reminder that the threat landscape remains active against this specific vector. Attackers are using the flaw to lock out administrative accounts, effectively denying legitimate users access to their network security appliances. This denial-of-service tactic can disrupt network management and security monitoring capabilities, leaving organizations vulnerable to further compromise or operational disruption.
Context and Background
The FortiBleed vulnerability has been a significant concern for network administrators since its identification. The flaw allows attackers to extract sensitive information from memory or, as noted in the current warning, trigger account lockouts. Infosecurity Magazine reported that the FBI and Secret Service are specifically emphasizing the ongoing nature of this threat. While many organizations may have assumed the immediate danger had passed after initial patches or mitigations were discussed, the federal agencies indicate that threat actors have not ceased their efforts.
The lockout mechanism is particularly damaging because it targets the administrative layer of the firewall. If administrators are locked out, they cannot update configurations, block malicious traffic, or respond to other incidents. This creates a cascading risk where a single successful lockout attempt can isolate an organization’s security controls. The warning underscores the importance of continuous monitoring rather than one-time remediation efforts.
Who Is Affected
Any organization utilizing Fortinet Fortigate firewalls is potentially affected by this warning. The alert is directed specifically at administrators responsible for managing these devices. The source material does not specify which versions of the firmware are currently vulnerable or which have been patched, but the implication is that systems still exhibiting the behavior are under active scrutiny by attackers.
Large enterprises, government contractors, and any entity relying on Fortinet hardware for perimeter security should review their administrative logs. The threat is not limited to a specific sector but applies to any deployment where the FortiBleed vector can be reached. The FBI and Secret Service’s involvement suggests that this is being treated as a significant threat to critical infrastructure and general network security.
What should you do?
Organizations should immediately audit their Fortinet devices for signs of unauthorized administrative lockouts. Reviewing logs for repeated failed login attempts or sudden access denials is a critical first step. Since the threat is ongoing, relying on past assessments is insufficient. Administrators should verify that their systems are configured to alert on such anomalies.
What to do and how to stay safe: Fortinet
- Monitor administrative logs on Fortinet devices for unusual patterns of failed login attempts or account lockouts.
- Verify that multi-factor authentication is enabled for all administrative access to Fortigate consoles to reduce the impact of credential-based lockouts.
- Ensure that network segmentation limits direct external access to administrative interfaces of firewall appliances.
- Once the vendor provides an update, apply patches immediately to address the underlying FortiBleed vulnerability.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the FBI and Secret Service warning about?
They are warning that Fortinet administrators are still being targeted by attacks using the FortiBleed vulnerability to lock out accounts.
Is this a new vulnerability?
No, the warning indicates that systems are still being targeted by existing threats, implying the issue is ongoing rather than a new discovery.
Who is affected by this warning?
Administrators managing Fortinet Fortigate systems are affected, as their devices are the specific target of these lockout attacks.
