FortiBleed 2.0 Exposes 40,573 FortiGate Secrets Across 975 Previously Unlisted Domains

Hudson Rock’s FortiBleed 2.0 investigation found 40,573 records with cleartext secrets in FortiGate configuration reports, exposing passwords and service credentials that could help attackers move beyond the firewall.

Published on October 27, 2026, the research also identifies 975 domain labels missing from the earlier FortiBleed dataset. These labels do not represent 975 newly confirmed company breaches.

The Hudson Rock investigation examined 1,703 configuration reports containing 101,419 credential and account records linked to 1,689 host identifiers. Most dated reports carry February 20, 2026 timestamps. Those dates describe the reports, not independently verified dates of compromise or configuration theft.

FortiGate Configuration Files Exposed

The cleartext records include 37,076 local-user entries, 1,576 Active Directory LDAP bind entries, 1,672 administrative logins, 144 high-availability cluster secrets, and 105 SMTP credentials. LDAP bind accounts let firewalls connect to directory services, making their exposure important beyond the appliance itself.

However, exposed secrets don’t equal working access. Researchers found 7,437 cleartext local-user records marked disabled. Administrative logins labelled verified reflect the source dataset, not fresh authentication tests. Blank multifactor authentication fields also don’t prove MFA was disabled.

The findings extend earlier FortiBleed credential theft, which described Fortinet’s warning about reused credentials and brute-force attacks. The new investigation adds account tables, directory connections, and stored secrets that a basic firewall login list would not reveal.

The reported toolchain links configuration extraction, secret recovery, VPN connection attempts, and checks against internal systems. A parsing script collects local users, administrator entries, LDAP settings, cluster secrets, and email credentials. Other tools attempt VPN access using eligible accounts. Success still depends on account status, network reachability, VPN rules, and MFA.

Some FortiOS configuration secrets use reversible encryption rather than one-way password hashing. Where configurations use the system-default encryption key, stored values can be recovered offline. Device-specific encryption keys can change that risk, so recovery depends on the firmware, settings, and material obtained.

An exposed LDAP password does not automatically grant domain administrator access. Its impact depends on the account’s permissions. An account with excessive rights increases risk, while ordinary directory lookup rights alone don’t provide control over Active Directory.

Of the 1,689 host identifiers, 924 were absent from FortiBleed 1.0. Researchers also found 1,453 domain labels across attribution fields, registration emails, and email-format usernames, including 975 absent from the earlier comparison set. Some labels may identify service providers or email services rather than victims.

FortiCloud SSO bypass report provides related background, but no single entry method has been established for every host in this dataset.

Fortinet’s response guidance recommends ending administrative and VPN sessions, resetting credentials, enforcing MFA, updating firmware, and restricting management access. Teams should compare configurations against trusted backups, investigate unknown accounts, and review firewall and domain controller logs for internal movement.

Organizations should also rotate exposed LDAP, cluster, and SMTP secrets while updating dependent services. Hudson Rock’s free lookup portal lets defenders check domain exposure and request disclosure details for comparison with their own records.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.