[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frQJRESen3qfuWHiODqL2PMuwt_go9pkvf7EjIt_2Lt8":3},{"article":4,"iocs":51,"watch_terms":59,"solutions":60,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"9bd598fd-fc32-4ca2-b0f8-10fd7e541af9","FortiBleed 2.0 Reveals Thousands of Fortinet VPN and Active Directory Credentials in Exposed Configurations","fortibleed-2-0-reveals-thousands-of-fortinet-vpn-and-active-directory-credential-639222","FortiBleed 2.0 investigation, published October 27, revealed 40,573 cleartext secret records in exposed FortiGate configurations, including 37,076 local-user passwords and 1,576 Active Directory LDAP bind records linking firewall access, VPN services, and internal identity systems. The researchers examined 1,703 configuration-report files containing 101,419 credential and account records associated with 1,689 host identifiers. The material also […] The post FortiBleed 2.0 Reveals Thousands of Fortinet VPN and Active Directory Credentials in Exposed Configurations appeared first on Cyber Security News.","FortiBleed 2.0 investigation revealed 40,573 cleartext secret records extracted from 1,703 exposed FortiGate configuration files, including 37,076 local-user passwords, 1,576 Active Directory LDAP bind records, and administrator credentials. The compromised data links firewall access, VPN services, and internal identity systems across 1,689 host identifiers, though it is not a newly disclosed vulnerability but rather a follow-up analysis of configuration files mostly dated February 2026. Security teams are advised to terminate sessions, reset credentials, enforce MFA, update firmware, and audit logs for unauthorized access attempts.","FortiBleed 2.0 exposes 40,573 cleartext credential records from Fortinet FortiGate configurations including VPN and","https:\u002F\u002Fcybersecuritynews.com\u002Ffortibleed-2-0-exposes-vpn-credentials\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FFortiBleed-2.0-Reveals-Thousands-of-Fortinet-VPN-and-Active-Directory-Credentials-in-Exposed-Configurations.webp","2026-10-28T10:19:22+00:00","2026-10-28T11:00:15.585656+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Fortinet","vendor",{"name":21,"type":22},"FortiGate","product",{"name":24,"type":22},"FortiOS",{"name":26,"type":27},"Active Directory LDAP","technology",{"name":29,"type":19},"Hudson Rock","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":30,"icon":32,"name":33,"slug":34},null,"Breaches","breaches",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"malware","FortiBleed 2.0","Credential extraction toolkit targeting FortiGate configurations to recover cleartext secrets and LDAP bind credentials",{"type":53,"value":57,"context":58},"Cavalier","Toolchain associated with FortiGate configuration theft; exposed 54 credential records across two hosts",[18,29,21],{"controls":61,"vendors":145},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":92,"name":93,"problem":94,"products":95},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[96,104,111],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":92,"product_name":108,"url":109,"description":110},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":120,"name":121,"problem":122,"products":123},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":133,"product_name":134,"url":135,"description":136},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",[146],{"slug":147,"name":18,"logo_path":148,"roles":149},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[150],"affected",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":163},"fortibleed-20-thousands-of-credentials-exposed-via-leaked-fortigate-config-files","FortiBleed 2.0: Thousands of Credentials Exposed via Leaked FortiGate Config Files","Over 40,000 cleartext credentials — including local-user passwords, Active Directory LDAP bind records, and administrator accounts — were extracted from 1,703 publicly exposed FortiGate configuration files. The root failure was the exposure of device configuration files containing sensitive secrets in plaintext, meaning a single misconfiguration or unpatched vulnerability translated directly into mass credential compromise. This matters because the leaked data bridges firewall access, VPN services, and internal identity systems, giving attackers a near-complete pathway into corporate environments. Storing credentials in cleartext within configuration files violates basic security hygiene and amplifies the blast radius of any exposure event enormously.",[156,157,158,159,160,161,162],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"OWASP A06:2021 Vulnerable and Outdated Components":166,"CIS Control 7: Continuous Vulnerability Management":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":169,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":170},"NIS2 requires essential and important entities to implement incident handling and access control measures including credential protection; exposing thousands of VPN and AD credentials through misconfigured network appliances is a direct breach of these obligations.","Many of the exposed configuration files dated to February 2026, suggesting delayed remediation cycles; SI-2 mandates timely identification and correction of system flaws to prevent lingering exposure.","Running unpatched FortiGate firmware with known vulnerabilities allowed attackers to access configuration files; this OWASP category directly addresses the risk of using outdated components that have publicly known exploits.","The configuration files linked to a known prior vulnerability chain (FortiBleed); continuous vulnerability scanning and timely patching of FortiGate firmware would have reduced the attack surface that allowed initial config file extraction.","The exposure exploited previously known FortiGate weaknesses; this control requires organisations to systematically identify, assess, and remediate technical vulnerabilities in a timely manner to prevent credential and configuration exposure.","Exposing configuration files containing plaintext credentials is a direct violation of secure configuration baselines; this control requires hardened, reviewed configurations for all network devices to prevent exactly this type of data leakage.","Cleartext LDAP bind passwords and administrator credentials in exposed configs represent a catastrophic identity control failure; PR.AA requires that credentials and access controls be protected with appropriate safeguards including encryption and MFA."]