FortiGate Configuration Files Expose Thousands of Secrets
The FortiBleed 2.0 investigation reveals over 40,000 cleartext credentials trapped in accessible firewall backup files.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do large-scale credential leaks from workplace IT infrastructure make you less confident in digital security?
An investigation into FortiGate firewall security, dubbed FortiBleed 2.0, has identified 40,573 cleartext secret records within exposed configuration files. Researchers analyzed 1,703 files associated with 1,689 unique host identifiers, revealing that sensitive system data remains accessible due to default encryption practices.
Why it matters
The findings underscore critical vulnerabilities in how hardware appliances manage and store configuration secrets, potentially allowing unauthorized access to enterprise networks via recovered credentials.
The analysis revealed 37,076 local-user passwords and 1,576 Active Directory LDAP bind records stored in cleartext. These secrets are recovered when FortiOS ENC values are decrypted offline using the system-default encryption key.
The players
Hudson Rock
A cybersecurity intelligence firm that specializes in analyzing credential exposure and monitoring dark web threats.
The details
The FortiBleed 2.0 methodology targets FortiGate configuration files that use the default system encryption key for data storage. By extracting these configurations and applying offline decryption to the ENC (encoded) values, researchers can expose stored secrets. The dataset also flagged 7,437 disabled local-user records that still contained valid cleartext credentials.
Timeline
February 20, 2026: Date assigned to the majority of the analyzed configuration-report files.
October 27, 2026: Publication date of the FortiBleed 2.0 investigation findings.
The Tech Race
This investigation follows the security pattern established by the original FortiBleed vulnerability disclosure. It marks a significant expansion in the scope of credentials exposed through automated configuration analysis.
System administrators managing FortiGate hardware should audit configuration backups to ensure secrets are not stored in cleartext. Organizations should immediately rotate credentials for any host identifiers identified in the research dataset.
The takeaway
The exposure of over 40,000 secrets highlights the danger of relying on default vendor encryption for sensitive system configurations. IT security teams should verify if their environment uses custom encryption keys rather than relying on standard factory defaults.
Further reading
Learn more about the latest developments in the field at Cybersecurity.
Live Poll
Do large-scale credential leaks from workplace IT infrastructure make you less confident in digital security?
