Widespread credential attacks hit Fortinet firewalls and VPNs

What happened

In June 2026 the ASD’s ACSC issued an alert about public reports of a widespread malicious campaign against Fortinet firewalls and VPN gateways. The campaign largely relied on exposed credentials and credential-based attacks, which could lead to device compromise and further exposure of passwords.

With those credentials, attackers could get remote access to the devices and the networks behind them, and change settings, including security controls. Fortinet published its own analysis and guidance, which the ACSC asked affected organisations to review.

Why it matters

Fortinet FortiGate firewalls and VPNs are common in Australian small and medium businesses, often installed by an IT provider. The firewall sits at the edge of your network and the VPN is how staff connect remotely, so control of either is a direct path in.

What the ACSC told organisations to do

• Rotate credentials immediately. Change all admin and VPN passwords.
• Patch devices, so attackers can’t use flaws in older firmware.
• Restrict management interface exposure. Firewall admin pages shouldn’t be reachable from the internet unless genuinely necessary.
• Enforce multi-factor authentication on all external access, so stolen passwords alone aren’t enough.
• Make sure credentials are stored with modern hashing (PBKDF2). After updating, log in to each admin account again so stored passwords are re-hashed.
• Review logs for unusual logins or configuration changes.

Questions to ask your IT provider

If someone else manages your firewall, ask:

• Do we use Fortinet devices, and are they on current firmware?
• Have all admin and VPN passwords been changed since this alert?
• Is MFA required for VPN access and admin logins?
• Is the management interface reachable from the internet?
• Have the logs been checked for unusual activity?

Our guides on two-step verification and choosing a managed IT provider explain why these controls matter.

Where to get help

Organisations that have been affected or need advice can call the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371).