The recent FortiBleed 2.0 investigation, disclosed on October 27, has unveiled a significant breach involving 40,573 plaintext secret records in exposed FortiGate configurations. This breach includes 37,076 local-user passwords and 1,576 Active Directory LDAP bind records that connect to firewall access, VPN services, and internal identity systems, highlighting a severe security concern for organizations relying on these services.
In-depth Analysis of Exposed Configurations
Researchers delved into 1,703 configuration-report files, uncovering 101,419 credential and account records linked to 1,689 host identifiers. These findings also encompass administrator login information, email-server passwords, and high-availability cluster secrets. It’s important to note that these figures represent records, not unique users or currently valid credentials.
Contrary to its name, FortiBleed 2.0 is not a new vulnerability but a follow-up to previously obtained files. Most of these files are dated February 20, 2026, with 31 remaining undated, leaving the timeline of initial access unverified.
Comparison with Previous Findings
Compared to the initial dataset, the latest investigation has identified an additional 924 host identifiers and 975 domain labels, which were absent in earlier collections. However, these domain labels may belong to service providers or registration contacts and do not represent newly compromised companies.
The toolchain associated with FortiBleed 2.0 extracts firewall configurations, retrieves stored secrets, and attempts further penetration. It efficiently gathers local user data, administrator entries, LDAP connections, cluster settings, and email credentials, using system-default encryption keys when possible.
Security Implications and Recommendations
Exposed local-user passwords could potentially allow VPN access, depending on account status, access rules, and the presence of multifactor authentication (MFA). The study identified 7,437 disabled local-user records containing plaintext data. The absence of MFA fields does not necessarily indicate a lack of MFA protocols, as external systems may enforce them.
Particularly concerning are the LDAP bind credentials, which link FortiGate devices to directory services. Accounts with elevated privileges could exacerbate the consequences of a security breach. However, regular LDAP query access does not automatically confer domain-admin rights.
Fortinet’s response advises terminating existing administrator and VPN sessions, resetting credentials, enforcing MFA, updating firmware, and limiting management access. Security teams should compare current configurations with trusted baselines and scrutinize firewall and domain-controller logs for unusual activities.
Investigators are encouraged to verify the legitimacy of recurring administrator accounts such as ‘fgtsecure’ and ‘forticloud-sync’ before assuming malicious intent, as account names alone do not confirm unauthorized access.
Organizations are urged to integrate threat intelligence from numerous SOCs to quickly address potential incidents, reinforcing network security against future threats.
