FortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Original title: FortiBleed 2.0 Exposes 40,573 FortiGate Secrets Across 975 Previously Unlisted Domains
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
Hudson Rock’s FortiBleed 2.0 review, published October 27, 2026, found 40,573 cleartext secret records in FortiGate configuration reports, including local users, LDAP bind accounts, administrative logins, high-availability cluster secrets, and SMTP credentials. The work examined 1,703 reports with 101,419 credential and account records. Most dated reports carry February 20, 2026 timestamps, which describe the reports rather than verified theft dates. Fortinet guidance cited in the report covers ending admin and VPN sessions, resetting credentials, enforcing MFA, updating firmware, and rotating LDAP, cluster, and SMTP secrets.
Unconfirmed: The 975 domain labels are not confirmed new company breaches, and report dates are not verified compromise dates.
- Records include 37,076 local-user, 1,576 LDAP bind, and 1,672 administrative login entries.
- Also counted were 144 cluster secrets and 105 SMTP credentials.
- Researchers marked 7,437 cleartext local-user records as disabled.
- Of 1,689 host identifiers, 924 were absent from FortiBleed 1.0.
- Some FortiOS secrets use reversible encryption and a default key can be recovered offline.
Impact: Cleartext firewall, LDAP, cluster, and SMTP credentials exposed
| Product | Affected |
|---|---|
| Fortinet FortiGate | — |
| Fortinet FortiOS | — |
- 1.End administrative and VPN sessions, reset credentials, enforce MFA, and update firmware.
- 2.Restrict management access and compare configurations with trusted backups.
- 3.Rotate exposed LDAP, cluster, and SMTP secrets and update dependent services.
- Vendors
- Fortinet
- Organizations
- Hudson Rock
From the original article
2 min read at gbhackers.com
Hudson Rock’s FortiBleed 2. 0 investigation found 40,573 records with cleartext secrets in FortiGate configuration reports, exposing passwords and service credentials that could help attackers move beyond the firewall. Published on October 27, 2026, the research also identifies 975 domain labels missing from the earlier FortiBleed dataset.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.