FortiGate and MikroTik: what to check on your router

Using a FortiGate firewall or a MikroTik router in your office? Check it this week. The FBI warns that attackers log in to FortiGate firewalls and VPNs with stolen passwords. CISA warns of a critical MikroTik flaw that lets an attacker take over the router without a password. New passwords, two-step login and a RouterOS update fix most of it.

FortiGate: stolen VPN and admin passwords

The FBI and US Secret Service published a joint advisory on 6 October 2026 about a campaign they call FortiBleed. Attackers use passwords leaked in earlier breaches, and passwords cracked from older FortiGate settings, to log in to firewalls that face the internet. The advisory cites more than 86,644 compromised devices in 194 countries.

Once inside, the attackers add their own admin accounts. Some victims were locked out of their own firewall, and the FBI says this access has been sold on to ransomware gangs. Passwords, admin settings and two-step login are the main fix.

MikroTik: critical flaw in RouterOS before 7.24

CISA published an advisory on 29 September 2026 for a flaw in RouterOS web management. An attacker who can reach the router's web page can run code on it with one crafted request, without logging in. It is rated 9.8 out of 10. MikroTik says to update to RouterOS 7.24 or later. CISA had no reports of attacks when it published.

What to do

For a FortiGate:

1. Do not leave the admin page open to the whole internet. Allow it only from your office or trusted addresses, or turn off internet admin access.
2. End all active admin and VPN sessions, then change every admin and VPN password to a new, long one.
3. Turn on two-step login (MFA) for VPN users and admins.
4. Look at the list of admin accounts. Any account you do not recognise is a warning sign.
5. On FortiOS 7.2.11 or later, follow Fortinet's guide to store admin passwords with the stronger PBKDF2 method.

For a MikroTik router:

1. Log in and check the RouterOS version under System.
2. Update to 7.24 or later from the official MikroTik download page.
3. Make sure the router's web management (WebFig) cannot be reached from the internet.

If someone else set up your router, send them this page. If you are locked out of your firewall, contact the company that installed it, and do not reset it before they have looked at it.

How SyncTech can help

For remote help with office IT, the SyncTech help centre shows how to reach our support team.

Source and credit

We are sharing these warnings from the FBI, the US Secret Service and CISA. This summary is written by Synctech in our own words.

• FortiBleed Operations Continue Targeting Exposed Systems Leading to Reports of Lockouts, FBI and US Secret Service, 6 October 2026: https://www.ic3.gov/CSA/2026/261006.pdf
• ICS Advisory ICSA-26-272-06, MikroTik RouterOS, CISA, 29 September 2026: https://www.cisa.gov/news-events/ics-advisories/icsa-26-272-06

Retrieved 26 October 2026. Fortinet, FortiGate and MikroTik are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.