FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
Original title: FortiBleed 2.0 Reveals Thousands of Fortinet VPN and Active Directory Credentials in Exposed Configurations
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
A FortiBleed 2.0 review published October 27 found 40,573 cleartext secret records in exposed FortiGate configurations, including 37,076 local-user passwords and 1,576 Active Directory LDAP bind records. Researchers examined 1,703 files with 101,419 credential and account records tied to 1,689 host identifiers. Hudson Rock says this expands an earlier dataset, but domain labels are not 975 newly compromised companies. Fortinet guidance is to end admin and VPN sessions, reset credentials, enforce MFA, update firmware, and restrict management access.
Unconfirmed: Initial access timing is unconfirmed, and the figures are records rather than unique users, confirmed devices, or credentials proven to still work.
- The material also includes administrator logins, email-server passwords, and high-availability cluster secrets.
- Most files are dated February 20, 2026, and 31 files are undated.
- Compared with the first dataset, 924 host identifiers and 975 domain labels were new.
- Hudson Rock identified 7,437 disabled local-user records that still contained cleartext data.
- Some FortiOS ENC values can be recovered offline when the default encryption key is used.
Impact: Cleartext VPN, admin, LDAP, email, and cluster secrets exposed
| Product | Affected |
|---|---|
| Fortinet FortiGate | — |
- 1.Terminate administrator and VPN sessions, reset exposed credentials, and enforce MFA.
- 2.Update FortiOS firmware and restrict management access.
- 3.Review LDAP bind, cluster, and email-server secrets and check firewall and domain logs.
- Vendors
- Fortinet
- Victims
- Cavalier
- Organizations
- Hudson Rock
From the original article
2 min read at cybersecuritynews.com
FortiBleed 2. 0 investigation, published October 27, revealed 40,573 cleartext secret records in exposed FortiGate configurations, including 37,076 local-user passwords and 1,576 Active Directory LDAP bind records linking firewall access, VPN services, and internal identity systems.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.