FortiBleed: Morocco’s DGSSI warns of a Fortinet credential leak hitting local organisations

In June 2026, Morocco’s cybersecurity agency flagged a campaign against Fortinet firewalls exposed to the internet. Around thirty organisations in Morocco were reported affected. What happened and what to check.

On 18 June 2026, Morocco’s Direction générale de la sécurité des systèmes d’information (DGSSI), through its maCERT team, issued an alert about a campaign known as “FortiBleed”. It concerns Fortinet firewalls and VPN gateways exposed to the internet, worldwide.

What happened

• According to the alert, attackers extracted configuration files from FortiGate devices reachable from the internet.
• They then cracked, offline, the password hashes stored in those files.
• With valid credentials, they can log in to the organisation’s VPN like a legitimate employee.
• Press reports cite around 75,000 devices affected worldwide, including around thirty organisations in Morocco.

Why it matters

A firewall is supposed to protect the network. When its credentials leak, it becomes an entrance instead. The attacker no longer needs to break anything: they log in with an account that works, which makes the intrusion harder to spot.

What to check

• Update Fortinet devices with the vendor’s security patches.
• Change every VPN and admin password, and do not reuse them.
• Turn on two-factor authentication for the VPN.
• Do not expose the firewall’s admin interface to the internet.
• Review recent VPN logins for unusual access, by time or by country.

A lesson beyond Fortinet

FortiBleed is a reminder that security equipment only protects you if it is maintained: updates, strong passwords, limited access. The same goes for a firewall as for the admin area of a website or online store.

A leaked password turns a reinforced door into an open one.

Sources: DGSSI / maCERT alert of 18 June 2026, Le Matin, Yabiladi, Morocco World News.

Want to secure access to your website and its admin? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.