Ports and Services: Why FortiGate Exposure Numbers Depend on the Question You Ask

On 18 June 2026, the Australian Cyber Security Centre (ACSC) published an alert titled "Reported widespread credential exposure affecting Fortinet Firewalls and VPN Gateways" [1]. The alert states that the ACSC "is aware of public reporting of a widespread malicious campaign against Fortinet Firewalls and VPN gateways, largely utilising exposed credentials and credential-based attacks, leading to potential compromise and further credential exposure" [1]. The ACSC warns that leveraging these credentials "could enable malicious actor's remote access to the devices and connected networks, as well as allow changes to various settings, including security controls" [1].

The alert does not name a CVE, does not publish an affected version list, and does not state how many devices or organisations were affected [1]. It describes credential-based attacks against internet-facing edge devices, not the exploitation of a newly disclosed software vulnerability [1]. The mitigation advice is operational: rotate all admin and VPN credentials immediately; ensure devices are patched against older-firmware vulnerabilities; restrict management interface exposure; enforce MFA on all external interfaces; store credentials with PBKDF2 hashing; and examine authentication and access logs for abnormal logins or changes [1]. An update section notes that Fortinet released a blog post and additional guidance, and directs affected organisations to review and monitor that post [1].

The Measurement Problem

When an event like this is reported, a common first question is: how many FortiGate devices are exposed? The answer depends entirely on the query used to ask it. ZoomEye observations from 23 September 2026 illustrate the point. A query for the product fingerprint alone, app="FortiGate", returned an exact count of 983996 internet-observable assets [2]. A query for the product fingerprint combined with a specific management port, app="FortiGate" && port=443, returned an exact count of 40828 [2]. A query for the same product fingerprint with a different port, app="FortiGate" && port=10443, returned an exact count of 47330 [2]. A query for the product fingerprint combined with a generic service label, app="FortiGate" && service="https", returned an exact count of 312970 [2].

These four figures describe the same product family on the same observation date, yet they differ by more than an order of magnitude. The reason is that each query answers a different question. The product fingerprint query asks how many assets ZoomEye can identify as FortiGate in any form. The port-specific queries ask how many of those assets expose a particular port. The service-label query asks how many expose a service that ZoomEye classifies as HTTPS, regardless of the port number. None of these queries asks how many devices are compromised, how many are vulnerable, or how many belong to victims. ZoomEye's reported count is the number of internet-observable assets matching the query; it is not a count of compromised devices, not a count of vulnerable devices, and not a count of victims [2].

Why the Gap Matters

The gap between 983996 and 40828 is not a rounding error. It is the difference between a broad product census and a narrow port-specific observation. If an analyst quotes the larger figure without the query, a reader may reasonably infer that nearly a million FortiGate devices are exposed on port 443. That inference is wrong. The larger figure includes assets observed on any port or service that ZoomEye associates with the FortiGate fingerprint. The smaller figure is the one that matches the specific port. Neither figure tells us how many devices are affected by the credential campaign described by the ACSC [1].

This distinction is not pedantic. In incident response and exposure review, the query determines the scope of the work. A team that needs to review internet-facing management interfaces should start from a query that targets those interfaces, not from a product census. A team that needs to understand the broader footprint of a product in a jurisdiction or network range should start from the product fingerprint and then narrow. Quoting a single number without its query collapses these different tasks into one misleading figure.

Using the Observations in This Scenario

The ACSC alert recommends restricting management interface exposure and examining authentication and access logs [1]. The ZoomEye observations can support the first of those tasks in a concrete, verifiable way. An organisation that wants to review its own FortiGate exposure can use the port-specific query app="FortiGate" && port=443 to identify internet-observable FortiGate assets that expose port 443 [2]. The same logic applies to app="FortiGate" && port=10443, which targets a port commonly used for administrative access [2]. These queries do not detect compromise, and they do not identify which devices belong to a given organisation. They identify internet-observable assets matching the query. That is the appropriate use: asset identification and exposure review, not incident confirmation.

For triage order, the port-specific counts are more actionable than the product census. If an organisation has a limited review capacity, starting with assets that match a management-port query is a defensible prioritisation, because the ACSC specifically advises that firewall admin and management interfaces should not be internet accessible unless necessary [1]. The product fingerprint count of 983996 is useful for understanding the size of the observable population, but it is not a triage list. The port-specific counts of 40828 and 47330 are closer to the kind of narrow observation that supports a review queue [2].

For continuous monitoring, the same queries can be run periodically to observe changes in the internet-observable population. A change in the count for app="FortiGate" && port=443 may reflect a change in exposure, a change in ZoomEye's observation coverage, or both. The observation is a measurement, not a diagnosis. It should be treated as one input among others, alongside the organisation's own asset inventory and authentication logs.

Measurement Hygiene

The ACSC alert does not provide a victim count, a CVE, or an affected version list [1]. Any figure that claims to represent the number of affected organisations is therefore not supported by the alert. The ZoomEye figures are similarly limited: they measure internet-observable assets, not affected assets [2]. The correct way to cite them is to include the exact dork, the exact count, and the observation date. For example: app="FortiGate" && port=443 returned an exact count of 40828 internet-observable assets on 23 September 2026 [2]. Without the dork, the count is not evidence. With the dork, it is a reproducible observation that others can verify and compare.

This is the core discipline that the FortiGate numbers illustrate. A number is only as useful as the question it answers. The question "how many FortiGate devices are exposed?" has at least four different answers depending on whether exposure is defined by product fingerprint, by port 443, by port 10443, or by a generic HTTPS service label. The ACSC alert describes a credential-based campaign against internet-facing edge devices [1]. The ZoomEye observations describe the observable population of FortiGate assets under different query definitions [2]. Neither source tells us how many devices are compromised. Both are more useful when the query is stated alongside the number.

References

[1] Australian Cyber Security Centre, "Reported widespread credential exposure affecting Fortinet Firewalls and VPN Gateways," published 18 June 2026, updated 22 June 2026. https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/reported-widespread-credential-exposure-affecting-fortinet-firewalls-and-vpn-gateways

[2] ZoomEye observations, 23 September 2026: app="FortiGate" exact_count=983996; app="FortiGate" && port=443 exact_count=40828; app="FortiGate" && port=10443 exact_count=47330; app="FortiGate" && service="https" exact_count=312970. ZoomEye's reported count is the number of internet-observable assets matching the query; it is not a count of compromised devices, not a count of vulnerable devices, and not a count of victims. https://www.zoomeye.org/