CVE-2026-24858 FortiBleed FortiGate Management API Credential Extraction Attempt

Kaung Khant Ko@kaungkhantko

•updated Jun 23, 2026•6•0•30

This rule detects attempts to extract credentials from FortiGate devices by targeting specific management API endpoints. It looks for HTTP GET requests to '/api/v2/cmdb/' followed by paths like 'system/admin', 'vpn.ssl.settings', or 'user/local', which are known to contain sensitive configuration or user data. This activity is associated with the 'FortiBleed' campaign and CVE-2026-24858.