Triage Order After a Credential-Exposure Advisory: What to Fix First on Fortinet Edge Devices

On 18 June 2026, the Australian Cyber Security Centre (ACSC) published an alert regarding widespread credential exposure affecting Fortinet Firewalls and VPN Gateways. This malicious campaign primarily utilizes exposed credentials and credential-based attacks targeting Fortinet devices. The advisory warns that such activity can lead to potential compromise and further credential exposure, enabling remote access to devices and connected networks.

The risk model here is not about a newly discovered software vulnerability but rather credential-based attacks against internet-facing edge devices.

The ACSC does not specify a CVE or affected version list, nor does it detail the number of devices or organizations impacted. The mitigation advice provided includes rotating all admin and VPN credentials immediately, patching devices against older-firmware vulnerabilities, restricting management interface exposure, enforcing MFA on external interfaces, and examining authentication and access logs for abnormal logins or changes.

While the list appears to invite parallel execution, a closer examination reveals a risk-sequencing problem. The four main workstreams—credential rotation, firmware currency, management-plane restriction, and MFA enforcement—differ in effort profiles, operational risk, and dependencies. Rotation, being the only control that directly addresses the reported attack path, should be executed first.

However, it is only durable if other controls follow. Firmware currency is a general hardening step and requires planning and execution without rushing. Restricting management interfaces and enforcing MFA are higher-effort controls that change the attack surface and raise the cost of stolen credentials. PBKDF2 hashing and log review are configuration changes and detective measures, respectively, that should be integrated into the overall process.