FortiBleed 2.0: Exposed VPN Credentials and Active Directory Secrets Increase Cybersecurity Risks

Executive Summary

FortiBleed 2.0 has revealed an expanded collection of FortiGate configuration records containing exposed credentials and sensitive authentication information. The dataset reportedly includes 40,573 records containing cleartext secrets, including local-user passwords, Active Directory LDAP credentials, administrator login records, SMTP credentials and high-availability cluster secrets. It also identifies 975 domain labels not present in the earlier dataset.  

The exposure creates a risk of unauthorised VPN access, identity compromise and lateral movement into internal networks. If exposed credentials remain valid, attackers could use them to access firewall management interfaces, authenticate to internal directory services or exploit excessive permissions to reach additional systems.

FortiBleed 2.0 is a follow-up investigation into exposed configuration data, not a newly disclosed Fortinet vulnerability. The presence of a credential in the dataset does not establish that it remains valid or that the associated organisation has been compromised. Organisations using FortiGate appliances should prioritise credential rotation, multifactor authentication (MFA), firewall configuration reviews and monitoring for suspicious authentication activity.

Who Is Affected?

Organisations should assess exposure if they:

• Operate Fortinet FortiGate firewalls or SSL VPN services.

• Use local firewall accounts or administrator credentials.

• Integrate FortiGate appliances with Active Directory through LDAP.

• Use SMTP credentials or shared secrets in firewall configurations.

• Operate high-availability firewall clusters.

• Allow external access to firewall management interfaces.

• Reuse passwords or operate without MFA on VPN and administrator accounts.

Recommendations

• Rotate exposed VPN, administrator, LDAP, SMTP and cluster credentials.

• Enforce MFA and restrict access to firewall management interfaces.

• Review FortiGate configurations, user accounts and Active Directory activity for unauthorised changes.

• Monitor VPN logins, suspicious authentication attempts and potential lateral movement through SIEM and EDR.

• Apply supported firmware updates, enforce least privilege and securely manage service credentials.

Conclusion

FortiBleed 2.0 highlights the risks of exposed firewall credentials, including unauthorised network access, identity compromise and potential data breaches. Organisations should prioritise credential security, access restrictions and continuous monitoring to reduce the likelihood of successful intrusion and protect critical systems.