Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesFortiBleed was still an active credential-compromise campaign in the FBI and U.S. Secret Service advisory of October 6, 2026. For organizations using internet-facing Fortinet FortiGate firewalls or SSL VPN gateways, the immediate task is to check for compromised identities and altered appliance configuration—not simply to install updates. Separately, an October 9 Patch Tuesday forecast anticipated updates across Microsoft and other vendors’ products; those predictions should not be treated as confirmed release details.
FortiBleed: what happened and who may be at risk
The FBI and U.S. Secret Service described FortiBleed as an active, global credential-compromise campaign targeting internet-facing FortiGate firewalls and SSL VPN gateways. It is a campaign using stolen credentials and access to compromised devices, not a newly disclosed Fortinet software vulnerability. The agencies reported that attackers were scanning exposed Fortinet firewalls and testing credentials obtained from older breaches and infostealer logs.
As an Amazon Associate I earn from qualifying purchases.
The advisory cites SOCRadar’s estimate of more than 86,644 compromised devices across 194 countries. That is a reported count of compromised devices, not a count of every exposed Fortinet appliance or a live census. CISA’s earlier June 18 bulletin referred to exposed credentials associated with approximately 74,000 devices. These are different measurements from different dates and should not be combined.
The campaign’s reported sequence shows why an exposed gateway can become an internal identity problem:
#1 Best Overall
- Scan internet-facing portals and test reused credentials through credential stuffing and password spraying.
- Extract password hashes from compromised devices and attempt offline cracking using a distributed GPU cluster.
- Create administrator accounts, enumerate Active Directory, and expand access.
- Package and sell working VPN access to other threat actors, including ransomware affiliates.
The October 6 advisory named INC/Lynx and Payload among affiliates receiving access at that time. This is a time-sensitive roster, not a permanent or exhaustive list. The FBI and Secret Service also warned that organizations could be locked out if attackers delete legitimate accounts or change their passwords.
What Fortinet gateway defenders should do
CISA’s June bulletin and the October joint advisory point to a layered response. A password reset or software update alone does not establish that an appliance is clean if an attacker may have changed accounts, configuration, or access paths.
Contain access and harden administration
- Terminate active VPN and administrative sessions, then reset credentials that could have been exposed or reused.
- Make firewall administration inaccessible from the public internet. Restrict management access to approved networks and administrative paths.
- Enable phishing-resistant multifactor authentication for remote-access and administrative accounts. A FIDO2 security key can be one implementation, but confirm compatibility with the organization’s identity provider, FortiGate configuration, and policies. MFA does not prove that a device is uncompromised.
- Confirm that credential storage uses PBKDF2, as CISA recommends.
Check identity, configuration, and logs
- Review administrator and API accounts for unauthorized additions or changes, and compare appliance configuration with a known-good baseline.
- Review firewall, VPN, authentication, and domain-controller logs for suspicious access, account changes, and signs of movement into internal systems.
- Plan for account recovery and possible lockout. If compromise is suspected, scope internal activity before eviction actions so the investigation can identify the extent of access.
- Vet indicators against current telemetry before blocking them. CISA cautions that hostile IP infrastructure can change ownership.
Use the CISA June 18 Fortinet bulletin and the FBI and U.S. Secret Service October 6 advisory for current response details and indicators. The agencies’ published indicators are time-sensitive and should be corroborated with organizational telemetry.
Recommended Free Tools
What the October 2026 Patch Tuesday forecast said
In a forecast published October 9, Ivanti Senior Product Manager Todd Schell expected Microsoft to address a high number of vulnerabilities across much of its portfolio, though he anticipated a decline from September’s volume. He also expected Adobe product updates, the usual Chrome for desktop 156 update, and at least one update among Firefox and Thunderbird. He did not expect another Apple update soon after September 29. These were predictions made before October’s release, not confirmation that the updates shipped as forecast.
Rank #3
Schell reported that September 2026 updates addressed 973 CVEs across Microsoft’s portfolio, with two known exploited and none publicly disclosed. This is Schell’s report of the September count, not an independently confirmed Microsoft tally in the forecast. Confirm actual vendor release notes and exploitation status before prioritizing October updates.
Forecasted lifecycle and bug-fix items
- Windows 11 version 24H2 Home and Professional: Schell expected the October release to include the final updates for these editions.
- Windows Server 2012 and 2012 R2: He expected extended security updates.
- Exchange Server 2016 and 2019: He expected extended security update support to end.
- Excel and Windows backup: He anticipated fixes for Excel cut-and-paste problems and File History/Windows Backup issues introduced by September updates.
Check Microsoft’s actual release notices before treating any of these forecast items as delivered or using them to make support decisions. Schell’s October 9 forecast explains the expectations and their context.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Office 2016 and 2019 need a separate support review
Schell highlighted confusion around Office 2016 and Office 2019. Their end-of-support date was October 14, 2025, but Microsoft continued issuing security updates afterward under a stated discretionary exception. Separately, an update intended to refresh Microsoft 365 applications reportedly removed or deactivated some Office 2016/2019 installations, and Microsoft paused it.
Organizations should inventory these installations and review migration plans, update channels, and the actual product versions in use. The reported disruption and support exception do not establish that every installation or update channel is affected in the same way.
Best Value
How to prioritize the week’s work
FortiBleed response and Patch Tuesday planning are related security work, but they answer different questions: the first concerns possible existing access to an organization’s network; the second concerns updates that were forecast, not yet confirmed in the cited article.
- If you operate an internet-facing Fortinet gateway, investigate first. Review exposure, sessions, credentials, administrator and API accounts, configuration integrity, and relevant logs.
- For any suspected compromise, scope before cleanup. Determine whether access extended to Active Directory or other internal systems, preserve recovery options, and coordinate incident response.
- For October patches, verify before deployment decisions. Check vendor release notes for shipped fixes, affected versions, known exploitation, and applicability to supported systems.
- Review lifecycle risks independently. Confirm Windows edition, server ESU status, Exchange support status, and Office versions against current vendor notices rather than relying on a forecast.
The October 11 roundup also mentioned Microsoft’s out-of-band Exchange Server update CVE-2026-96940 and a CISA Known Exploited Vulnerabilities catalog addition for Citrix NetScaler CVE-2026-88779. Those are separate developments, not part of the October Patch Tuesday forecast.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
