ACSC Alert Flags Widespread FortiGate Compromise
On June 18, 2026, the Australian Cyber Security Centre (ACSC) issued a stark warning regarding widespread credential exposure affecting Fortinet Firewalls and VPN gateways. The alert, titled "Reported widespread credential exposure affecting Fortinet Firewalls and VPN Gateways," noted a significant malicious campaign leveraging exposed credentials. This campaign grants attackers potential remote access to devices and connected networks, along with the ability to alter critical security settings.
Crucially, the ACSC alert does not specify a CVE number, affected versions, or a precise number of compromised devices or organizations. It broadly describes credential-based attacks targeting internet-facing edge devices. This lack of specific technical detail has led to varied interpretations of the scale of the problem, particularly when discussing exposed ports versus exposed services.
Understanding the Nuance: Ports vs. Services
The core of the ambiguity lies in how one defines and counts "exposure." When security researchers or organizations scan the internet for vulnerable devices, they often look at two distinct but related metrics: open ports and running services.
Open Ports: A port is essentially a communication endpoint on a device. If a port is open, it means a service is listening for connections on that port. Internet-wide scans commonly report the number of devices with specific ports open to the public internet. For example, a scan might reveal millions of devices with port 443 (HTTPS) open. However, an open port does not automatically equate to a vulnerable service or an exploitable weakness. It simply indicates that something is listening.
Running Services: This metric goes a step further. It not only identifies an open port but also attempts to determine what service is actually running on that port and its version. A service might be running on port 443, but it could be a standard web server, a specific application gateway, or even a misconfigured service. Identifying the service and its version is critical for determining if a known vulnerability exists.
Why This Distinction Matters for FortiGate
The ACSC alert, by focusing on "credential exposure" and "credential-based attacks," implicitly points to services that are accessible and potentially susceptible to brute-force or credential stuffing attacks. These are typically management interfaces or VPN portals.
When security researchers report on FortiGate exposure, the numbers can differ dramatically depending on their methodology:
- Querying for Open Ports: If a scan simply looks for devices responding on common FortiGate management ports (e.g., TCP 443 for the web GUI, UDP 500/4500 for IKE/IPsec VPN, TCP 10443 for additional management), the number of "exposed" devices could be in the millions. This counts any FortiGate device that has these ports open to the internet, regardless of whether the service is properly secured, updated, or even accessible for login.
- Querying for Specific Services/Vulnerabilities: A more refined scan would attempt to identify the specific FortiOS service running on those ports and check for known vulnerabilities or default/weak credentials. This approach yields a much smaller, but far more accurate, number of genuinely at-risk devices. The ACSC alert suggests that attackers are targeting these specific, accessible services.
Consider the analogy of a building's doors. Counting open doors (ports) might reveal thousands of entrances. But only a few of those doors might have faulty locks or be left ajar (vulnerable services), making them the actual entry points for intruders. The ACSC alert is concerned with the latter – the doors with faulty locks.
The Implications of Ambiguity
The lack of precise technical indicators in the ACSC alert creates a challenge. Organizations relying solely on broad internet scans might overestimate or underestimate their risk. A high number of "exposed" devices based on open ports could cause unnecessary alarm or lead to a dilution of focus. Conversely, a low number might provide a false sense of security if the scanning methodology isn't sensitive enough to detect the specific services being targeted.
For administrators, this means looking beyond simple port scans. It requires:
- Verifying Service Accessibility: Ensure that management interfaces and VPN portals are not unnecessarily exposed to the public internet. Use access control lists (ACLs) and firewall policies to restrict access to trusted IP addresses only.
- Patching and Updates: Keep FortiOS up-to-date with the latest security patches. The ACSC alert implies that attackers are exploiting known or easily discoverable weaknesses.
- Strong Credential Management: Implement strong, unique passwords for all administrative accounts. Enable multi-factor authentication (MFA) wherever possible, especially for VPN access.
- Reviewing Logs: Monitor firewall and VPN logs for suspicious login attempts, unusual traffic patterns, or signs of compromise.
What remains unaddressed is the exact nature of the "credential exposure" the ACSC refers to. Is it a widespread default password issue, a specific vulnerability allowing credential harvesting, or simply the result of weak, reused passwords on services that are already exposed?
Conclusion: A Call for Specificity
The ACSC's alert serves as a critical reminder that cybersecurity metrics are only as useful as the questions they answer. While broad scans for open ports can indicate potential attack surfaces, they do not reflect the actual threat landscape. The number of genuinely vulnerable FortiGate devices is likely far smaller than the number of devices with open management or VPN ports. However, the ongoing campaign underscores that even a small number of exploitable services, when widely targeted, can lead to significant compromises. Organizations must focus on securing specific services, managing credentials rigorously, and staying vigilant against evolving threats, rather than relying on ambiguous exposure numbers.