FortiBleed 2.0 Reveals Thousands of Fortinet VPN and Active Directory Credentials in Exposed Configurations

FortiBleed 2.0 investigation, published October 27, revealed 40,573 cleartext secret records in exposed FortiGate configurations, including 37,076 local-user passwords and 1,576 Active Directory LDAP bind records linking firewall access, VPN services, and internal identity systems.

The researchers examined 1,703 configuration-report files containing 101,419 credential and account records associated with 1,689 host identifiers.

The material also includes administrator logins, email-server passwords, and high-availability cluster secrets. These figures reflect records, not unique users, confirmed physical devices, or credentials that still work today.

Despite its name, FortiBleed 2.0 is a follow-up investigation based on recently obtained files, not a newly disclosed vulnerability. Most files are dated February 20, 2026, while 31 are undated, leaving the timing of initial access and configuration theft unconfirmed.

FortiBleed 2.0 Exposes Fortinet VPN and AD Credentials

Compared with the first dataset, researchers identified 924 additional host identifiers and 975 domain labels absent from the earlier collection.

However, domain labels can belong to service providers, registration contacts, or account holders. They should not be read as 975 newly compromised companies. The findings expand earlier FortiBleed credential exposure coverage by revealing accounts and services behind perimeter logins.

The associated toolchain extracts firewall configurations, recovers stored secrets, and attempts further access. Its parsing workflow collects local users, administrator entries, LDAP connections, cluster settings, and email credentials.

Some stored FortiOS ENC values can be recovered offline when configurations use the system-default encryption key. Recovery depends on the software version, settings, and available material.

Exposed local-user passwords may support VPN access, but account status, access rules, reachability, and multifactor authentication determine whether login succeeds.

Hudson Rock’s analysis identified 7,437 disabled local-user records containing cleartext data. Empty MFA fields do not necessarily indicate missing MFA, as external authentication systems may enforce it.

LDAP bind credentials deserve close attention because they connect FortiGate appliances to directory services. An account with excessive rights could increase the impact of a breach.

Ordinary LDAP query access, however, does not automatically grant domain-administrator privileges. Earlier reporting on FortiGate configuration theft highlights this route toward internal access.

Fortinet’s response guidance calls for terminating administrator and VPN sessions, resetting credentials, enforcing MFA, updating firmware, and restricting management access.

Security teams should compare current settings with a trusted configuration and examine firewall and domain-controller logs for unexpected activity. The configuration findings also call for reviewing LDAP bind passwords, cluster secrets, and email-server credentials.

Investigators should verify ownership of recurring administrator accounts such as fgtsecure and forticloud-sync before treating them as unauthorized. Account names alone do not establish malicious activity.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post FortiBleed 2.0 Reveals Thousands of Fortinet VPN and Active Directory Credentials in Exposed Configurations appeared first on Cyber Security News.