Credential exposureThu, 29 Oct 2026
FortiBleed 2.0: investigate FortiGate configuration and credential exposure
Review current and retired FortiGate appliances, restrict management access, and investigate VPN, LDAP and other credentials that may have been exposed.
Article
Hudson Rock’s October 27 follow-up analyzed 1,703 older configuration reports. It counted 40,573 records containing plaintext secrets, including 1,576 Active Directory LDAP account records, and identified 975 domain labels absent from its earlier dataset. These figures do not establish how many organizations were affected or how many credentials remain valid.
Most reports are dated February 2026. Their report dates do not establish when intrusion or collection occurred. Verify exposure against your appliance inventory, configuration history and logs.
- 01
Obtain a configuration file or backup
- 02
Try still-valid administrator, VPN or LDAP credentials
- 03
Change rules or use a service identity to reach internal systems
- 01
Inventory and restrict management access
Include retired, managed and HA devices. Restrict management interfaces to trusted sources.
See what to doResources: 1
TWISA member solutions
Inventory and restrict management access
Include retired, managed and HA devices. Restrict management interfaces to trusted sources.
- 02
Preserve records and compare configurations
Save configuration, management sign-in and VPN logs. Compare them against a trusted baseline.
See what to doResources: 1
TWISA member solutions
Preserve records and compare configurations
Save configuration, management sign-in and VPN logs. Compare them against a trusted baseline.
- 03
Rotate potentially exposed secrets
Terminate relevant sessions and plan password and key rotation in dependency order.
See what to doResources: 1
TWISA member solutions
Rotate potentially exposed secrets
Terminate relevant sessions and plan password and key rotation in dependency order.
- 04
Investigate internal access and recover
Correlate directory, jump host and endpoint logs. Follow Fortinet recovery guidance and retest.
See what to doResources: 1
TWISA member solutions
Investigate internal access and recover
Correlate directory, jump host and endpoint logs. Follow Fortinet recovery guidance and retest.
Allow authorized traffic and apply controls at each layer.
- 01
Inventory and restrict management access
Include retired, managed and HA devices. Restrict management interfaces to trusted sources.
- 02
Preserve records and compare configurations
Save configuration, management sign-in and VPN logs. Compare them against a trusted baseline.
- 03
Rotate potentially exposed secrets
Terminate relevant sessions and plan password and key rotation in dependency order.
Feed logs and traffic data from each layer into monitoring and response.
- Investigate internal access and recoverCorrelate directory, jump host and endpoint logs. Follow Fortinet recovery guidance and retest.
TWISA member solutions
Inventory and restrict management access
Include retired, managed and HA devices. Restrict management interfaces to trusted sources.
Preserve records and compare configurations
Save configuration, management sign-in and VPN logs. Compare them against a trusted baseline.
Rotate potentially exposed secrets
Terminate relevant sessions and plan password and key rotation in dependency order.
Investigate internal access and recover
Correlate directory, jump host and endpoint logs. Follow Fortinet recovery guidance and retest.
Sources and further reading
- Hudson Rock research
- HKCERT guidance
- Fortinet investigation and recovery guidance
- Related Fortinet update (Traditional Chinese)
Alert updated: 2026/10/29. Check the vendor’s latest guidance for product support and patch status.