Free tools Windows power users keep installed
One-click scans. No signup required.
CISA reported that global reports associated leaked credentials with approximately 74,000 Fortinet devices. That figure describes reported exposure; it does not establish that 74,000 devices were accessed, successfully compromised, or used to reach their organizations’ networks. The advisory does not disclose the underlying dataset or explain how it counted and deduplicated devices.
What the approximately 74,000 figure means
In its June 18, 2026 advisory, the Cybersecurity and Infrastructure Security Agency (CISA) described approximately 74,000 Fortinet devices—including firewalls and VPN gateways—as associated with exposed leaked credentials in global reports. The number should be attributed to CISA and kept approximate. It is a reported exposure count, not a count of confirmed successful intrusions. CISA’s advisory does not provide the underlying dataset, collection procedure, or deduplication method.
As an Amazon Associate I earn from qualifying purchases.
A count can establish what a particular source says was associated with a dataset, within that source’s definitions and collection window. On its own, it cannot establish that every record represents a unique device, that a credential was still valid when reported, or that anyone used it to access a device. Nor does it show that an attacker reached an organization’s wider network.
What would establish access or compromise?
Moving from exposure to a claim of unauthorized access requires device-specific corroboration. Relevant evidence can include validated credential status, firewall or VPN logs showing suspicious authentication, unauthorized configuration changes, suspicious account creation, and other incident indicators. Evidence of access still does not, by itself, establish downstream compromise of an organization’s network; that requires evidence about what happened after access.
#1 Best Overall
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 3 years of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
CISA’s advisory recommends reviewing operational evidence such as firewall, VPN, authentication, and domain-controller logs. Its response guidance does not treat the headline count as proof that every listed device was compromised.
How Fortinet’s analysis differs from CISA’s advisory
Fortinet’s June 19, 2026 analysis offered the vendor’s initial assessment of the reported activity. It said the campaign involved reuse of credentials from earlier incidents and brute-force activity against devices with weak password hygiene and no MFA. Fortinet stated: “This is not a new Fortinet vulnerability, and this activity is not related to any recent incident or advisory.” This is Fortinet’s assessment, not independent verification of the origin or validity of every credential associated with the reported count. Fortinet’s analysis also asks readers, “Was My Organization Affected?”
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
The sources have different roles: CISA’s advisory reports the approximate device figure and provides hardening guidance; Fortinet’s analysis gives the vendor’s initial interpretation of the activity and its own response recommendations. Neither role turns the approximate count into a device-by-device finding of successful access.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why the metric label matters
“Credential exposure” does not have one universal counting definition. Fortinet’s documentation for FortiWeb Cloud 24.1.0 defines its “Credential Exposure” indicator as email addresses related to organizational domains that appear in third-party credential breaches. Its separate “Stealer Infection” indicator concerns potentially infected affiliated systems whose data is leaked or for sale. Those are distinct product categories, not equivalent counts of confirmed intrusions. The definitions describe FortiWeb Cloud’s dashboard and do not establish how the dataset referenced by CISA’s Fortinet advisory was compiled. Fortinet’s FortiWeb Cloud documentation
Rank #3
- Complete Security and Hardware Offering: Includes FortiGate-40F with 1 year of FortiCare Premium and FortiGuard Enterprise Protection.
- Comprehensive Enterprise Services: Features advanced services such as CASB, DLP, IoT security measures, and attack surface assessments.
- Enhanced Threat Detection and Prevention: Integrates AI-based malware prevention for proactive security measures.
- Robust Support Network: FortiCare Premium offers access to technical expertise for optimal device operation and security management.
- Suitable for Varied Environments: Ideal for environments requiring detailed and layered security approaches.
Questions to ask when comparing exposure reports
- Unit counted: Is the figure about devices, accounts, email addresses, credentials, or records?
- Population and scope: Which products, services, organizations, and geographies are included?
- Time window: When was the data collected, and how old might the underlying credentials be?
- Deduplication: Were multiple records associated with one device or account collapsed into a single count?
- Validation: Were credentials tested as current, or merely observed in a dataset?
- Evidence level: Does the source show exposure, attempted authentication, successful access, or confirmed downstream compromise?
- Attribution: Is the statement from a vendor, an agency summarizing third-party reporting, or the original dataset publisher?
The public CISA advisory does not disclose enough about the underlying reports to answer all of these questions for its approximately 74,000-device figure. The count should therefore not be used to infer a more precise scope or evidence level than the advisory states.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations should do with the advisory
Organizations using affected Fortinet devices can act on CISA’s and Fortinet’s response guidance without treating the count as proof of their own compromise. CISA recommends terminating active SSL VPN and administrative sessions; resetting Fortinet VPN and administrative passwords; confirming PBKDF2 use for administrator credential storage and removing weaker legacy hashes in line with Fortinet guidance; reviewing firewall, VPN, authentication, and domain-controller logs; enabling phishing-resistant MFA for remote-access and administrative accounts; and removing public internet exposure from firewall administration or restricting it to trusted internal networks. CISA advisory
Rank #4
- Protects against known exploits, malware and malicious websites; detects unknown attacks; identify thousands of applications
Fortinet likewise recommends terminating sessions, resetting passwords, enabling MFA, using supported software versions that support PBKDF2, comparing configuration against a known-good baseline, reviewing logs, and reducing external management exposure. If there is evidence of unauthorized configuration modification or other indicators, Fortinet advises treating the device as compromised and following recovery guidance. These are response measures, not findings that every device associated with reported credentials was compromised. Fortinet analysis
Quick Recap
Best Value
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
- Including award-winning FortiGate hardware and 1-year FortiGuard AI-powered UTP security services. Services cover IPS, Advanced Malware Protection, Application Control, URL, DNS & Video Filtering, Antispam Service, and FortiCare Premium customer support.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
