Sophos Firewall and FortiBleed

This page scopes Sophos Firewall defensive action after Sophos published an informational advisory connecting Sophos Firewall brute-forcing/stuffing activity to the broader FortiBleed-adjacent threat-actor reporting. The core question is whether internet-exposed Sophos Firewall portals were reachable with credentials that lacked effective MFA protection, not which Sophos CVE was exploited.¹

• Sophos published an informational advisory after receiving third-party information that the same threat actors tied to FortiBleed also targeted internet-exposed Sophos Firewall appliances. ¹
• The Sophos-specific activity is framed as user-level credential brute-forcing/stuffing, not malware deployment or exploitation of a Sophos Firewall vulnerability. ¹
• Sophos had not observed indications of compromise on reviewed Sophos devices and had not seen evidence of Sophos Firewall vulnerability exploitation. ¹
• The highest-value scoping question is whether MFA was actually enrolled and enforced for the exact Sophos Firewall Admin, User, and VPN portal accounts involved. ¹
• If the same organization also runs Fortinet/FortiGate edge devices, run the FortiBleed validation track separately: lookup, session termination, credential rotation, management exposure restriction, and Fortinet log review. ^1,2,4

Sophos's advisory is best read as a credential-stuffing and edge-access warning, not a new vulnerability announcement. Sophos says it received third-party information that the same threat actors associated with FortiBleed also targeted Sophos Firewall appliances exposed to the internet. The activity identified so far focused on user-level accounts through credential brute-forcing or stuffing.¹

The most important caveat is defensive and legal: Sophos states that reviewed telemetry had not shown indications of compromise on affected Sophos devices, and Sophos had not seen anything suggesting exploitation of a Sophos Firewall vulnerability. That means a Sophos Firewall/VPN case should be scoped aggressively, but not described as a Sophos exploit or confirmed compromise without local proof.¹

The practical issue is MFA coverage. Sophos says the threat actor targeted Sophos Firewall appliances that lacked MFA protection and directs customers to enroll MFA for all users who can authenticate to Admin, User, or VPN portals. In a real scoping call, "MFA is enabled" is not enough; teams need evidence that MFA applied to the specific account, portal, group, local user path, and session involved.¹

For organizations that also run Fortinet devices, the Sophos advisory keeps the FortiBleed response active: inventory FortiGate/FortiOS/FortiProxy/FortiWeb and related edge devices, terminate active SSL VPN/admin sessions, rotate Fortinet local admin/VPN/API/service credentials, rotate backend authentication secrets, restrict management exposure, patch/harden, and enable Fortinet telemetry integration where possible.^1,2,4,6,7,8

Valid credentials on internet-facing edge devices can be enough to create a serious incident even when no new CVE exists. Sophos's advisory is useful because it separates three things that are often conflated on scoping calls: attempted credential stuffing, successful login, and confirmed compromise. It also clarifies why MFA must be validated at the exact authentication-path level rather than assumed from a broad policy statement.¹

Caveat: this page should not turn advisory-level targeting into a named victim list. Add named rows only when a reliable public source or authorized customer disclosure identifies the organization and ties the statement to Sophos Firewall exposure or impact.