Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

FortiBleed 2.0 review finds 40,573 cleartext FortiGate secrets

2 sources · 2 articlesFirst reported Updated ()4
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Hudson Rock’s October 27 FortiBleed 2.0 review found tens of thousands of cleartext FortiGate secrets; validity is unconfirmed.

Hudson Rock’s FortiBleed 2.0 review, published October 27, examined exposed FortiGate configuration files rather than a new Fortinet flaw. Researchers parsed 1,703 reports containing 101,419 credential and account records tied to 1,689 host identifiers and found 40,573 cleartext secret records, including 37,076 local-user passwords and 1,576 Active Directory LDAP bind records. The set also includes administrative logins, SMTP credentials, and high-availability cluster secrets; 7,437 disabled local-user records still held cleartext data. Compared with the earlier dataset, 924 host identifiers and 975 domain labels were new, but those labels are not 975 newly compromised companies. Most dated files carry February 20, 2026 timestamps, which describe the reports rather than verified theft dates, and the records are not confirmed still valid. Fortinet guidance cited covers ending admin and VPN sessions, resetting credentials, enforcing MFA, updating firmware, restricting management access, and rotating LDAP, cluster, and SMTP secrets.

Key facts
  • 40,573 cleartext secrets include 37,076 local-user and 1,576 LDAP bind records.
  • Also counted: 1,672 admin logins, 144 cluster secrets, and 105 SMTP credentials.
  • 7,437 disabled local-user records still contained cleartext data.
  • 924 of 1,689 host identifiers and 975 domain labels were new versus FortiBleed 1.0.
  • Some FortiOS secrets use reversible encryption recoverable offline with the default key.
  • 31 of the examined files are undated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Feb 20, 2026Most examined FortiGate configuration reports carry this date. · Cyber Security News
  2. Oct 27, 2026Hudson Rock published the FortiBleed 2.0 configuration review. · Cyber Security News

What each outlet adds

beyond the shared facts
  • Cyber Security NewsSays records are unconfirmed and domain labels are not newly compromised companies.
  • GBHackersBreaks out admin, cluster, and SMTP counts; dates are report timestamps, not theft dates.
Vendors
Fortinet
Products
FortiGateFortiOS
Victims
Cavalier
Organizations
Hudson Rock

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Cyber Security NewsFirst report

    FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs

    The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.

  2. · 2d ago GBHackers

    FortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs

    Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.