Security Alert

The follow-up investigation into the FortiBleed credential exposure incident has revealed new findings. Researchers recently obtained a set of earlier FortiGate configuration reports and named the follow-up investigation FortiBleed 2.0. The newly obtained dataset expands the known scope and depth of the exposure by adding more detailed FortiGate configuration records, including credentials and secrets associated with local users, administrator accounts, Active Directory LDAP connections, high-availability clusters and SMTP services, as well as records for hosts absent from the earlier comparison dataset.

According to the latest threat intelligence report, the FortiBleed 2.0 dataset contains over 100,000 credential and account records. Records containing cleartext data include the following types:

Cleartext local-user secret records

Cleartext Active Directory LDAP bind-account secret records

Cleartext administrator-login records labelled as verified logins in the source dataset

Cleartext high-availability cluster secret records

Cleartext SMTP credential records

The analysis also identified 975 domain labels absent from the earlier FortiBleed dataset. The total number of credential and account records and the number of domain labels do not correspond to numbers of unique users, credentials that remain valid, or newly confirmed affected organisations.

HKCERT issued a security alert in June 2026 regarding the FortiBleed credential exposure incident. The incident involved suspected exposure of data and login credentials associated with Fortinet FortiGate firewalls and VPN appliances. The FortiBleed 2.0 investigation provides additional configuration data and account records, supplementing information not captured in the earlier dataset.

In addition, FortiBleed 2.0 comprises newly obtained material from an earlier period. Most source files have report dates in February 2026, predating the material examined in the first investigation, which was believed to date from May or June of the same year. It should therefore not be interpreted as a new wave of attacks; the report dates also do not establish when the actual compromise or data extraction occurred.

In terms of coverage, FortiBleed 2.0 also includes records for hosts absent from the earlier comparison dataset. A host identifier may be an IP address or DNS hostname and does not necessarily represent one unique appliance or organisation. Therefore, even if an organisation has already completed a domain check in accordance with HKCERT’s June alert, it should check again using the updated dataset.

For background on the earlier incident and recommended actions, please refer to HKCERT’s security alert issued in June 2026: Security Alert - FortiBleed Credential Leak Incident: Over 70,000 Fortinet Devices Suspected to Be Affected by Data and Credential Exposure, Hong Kong Organisations May Be Affected

FortiGate configuration files may contain credentials and network information used by an appliance to connect to other systems within an organisation. If an attacker obtains the relevant configuration data, the impact may extend beyond the firewall appliance itself.

Depending on the affected configuration and the privileges assigned to the exposed accounts, the following are potential risks to assess; the dataset does not establish that each activity occurred:

Gain unauthorised access to the FortiGate management interface or VPN services

Use exposed local-user credentials to access remote services

Abuse Active Directory LDAP bind accounts or service accounts

Identify internal directory servers and other network infrastructure

Modify firewall policies, administrator accounts or security settings

Move laterally within the organisation’s internal network

Use exposed service credentials to access other connected systems

Deploy malware, ransomware or other persistent backdoors

Steal additional credentials, business data or sensitive information

The presence of secrets in cleartext does not mean that all associated credentials remain valid or usable. Some records may relate to disabled accounts, historical configurations or services for which the credentials have already been changed. Nevertheless, organisations should treat the relevant records as potentially exposed and verify them against their asset inventories, configuration-change records and account information.

HKCERT calls on all organisations using Fortinet firewalls, VPNs or related appliances to reassess their risk immediately. Even if an organisation has already completed checks in accordance with HKCERT’s June 2026 alert, it should use the following portal to check again whether its domains appear in the updated dataset and assess whether it may have been affected by the data exposure:

HKCERT recommends that organisations take the following actions:

Check again for potential exposure Even if earlier checks have been completed, organisations should use the FortiBleed lookup portal to check domains currently or previously used by the organisation. Relevant IP addresses and hostnames should also be reconciled with historical asset inventories.

Review all relevant appliances Inventory all FortiGate appliances currently or previously deployed, including appliances that have been replaced, decommissioned, reassigned or assigned different IP addresses. Confirm whether each appliance is or was managed by the organisation, a third-party supplier or a managed service provider.

Restrict management access Avoid exposing management interfaces directly to the Internet. Restrict management access through trusted management networks, VPNs, IP allowlists or other appropriate access controls.

Reset administrator and VPN credentials Immediately rotate potentially exposed administrator, privileged, local-user and VPN credentials that remain relevant. Terminate associated login sessions and reset any exposed passwords reused on other systems.

Review LDAP accounts Identify Active Directory LDAP bind accounts and related service accounts. Rotate potentially exposed credentials, remove unnecessary elevated privileges and review anomalous login activity. Exposure of an LDAP bind account does not by itself establish elevated directory privileges; assess the account’s actual permissions and authentication history.

Rotate other configuration secrets In addition to the HA, RADIUS and SMTP secrets expressly identified in the source article, HKCERT recommends, as an additional precaution, reviewing and replacing where necessary any API, automation-integration and third-party support-account credentials, as well as digital certificates and private keys, stored in or referenced by FortiGate configurations.

Enable multi-factor authentication Enable multi-factor authentication for all administrator and remote-access accounts. Verify the effective MFA configuration across FortiGate, RADIUS, single sign-on platforms and external identity services.

Review accounts and configurations Compare all administrator, local-user and VPN accounts with approved account lists. Compare the current configuration with known-good versions and historical backups, and investigate any unauthorised accounts or configuration changes.

Review logs and internal activity Review administrator and VPN logins, configuration exports, account and privilege changes, and anomalous LDAP, RADIUS and SMTP activity. Correlate the findings with Active Directory, endpoint detection and response systems, and other internal security logs.

Apply relevant security updates Follow Fortinet’s official security advisories and upgrade FortiOS and other affected products to the latest supported secure versions. However, if data has already been exposed, organisations must still complete credential rotation, configuration review and incident investigation.

Initiate incident-response procedures If anomalous logins, unauthorised accounts, configuration changes or possible misuse of relevant credentials are identified, immediately restrict or isolate the affected appliances, preserve evidence, and investigate the internal network for lateral movement, persistence mechanisms or malware activity.

Businesses or members of the public who wish to report to HKCERT on information security related incidents such as malware, phishing, denial of service attacks, etc. can do so by completing the online form at: , or calling the 24-hour hotline at +852 8105 6060. For further enquiries, please HKCERT at [email protected] .

FortiBleed 2.0: 975 New Domains & 40,573 Exposed Secrets – Claim Your Ethical Disclosure