FortiBleed 2.0: HKCERT Urges FortiGate Users to Check Again

HKCERT says FortiBleed 2.0, newly obtained FortiGate configuration data, holds 100,000+ credential records, some in cleartext. Checked in June? Check again.

Hong Kong's computer emergency response team, HKCERT, issued a new alert on 28 October 2026 about "FortiBleed 2.0": a further batch of leaked FortiGate firewall configuration data that contains more than 100,000 credential and account records, some of them in cleartext. If your business uses a Fortinet FortiGate firewall or FortiGate VPN, HKCERT asks you to check again, even if you already checked after the first FortiBleed alert in June.

What happened

In June 2026, HKCERT and the US agency CISA warned about "FortiBleed", a leak of credentials linked to roughly 74,000 Fortinet firewalls and VPN devices in more than 194 countries. HKCERT said some Hong Kong organisations may be affected. Fortinet said this was not a new vulnerability: it believes attackers reused credentials from earlier incidents and used brute-force password guessing against devices with weak passwords and no multi-factor authentication (MFA).

The follow-up investigation, named FortiBleed 2.0 by threat-intelligence firm Hudson Rock, is based on a newly obtained set of FortiGate configuration reports. According to HKCERT, the dataset:

contains over 100,000 credential and account records;
includes cleartext records for local users, Active Directory LDAP bind accounts, administrator logins, high-availability (HA) cluster secrets and SMTP (email server) credentials;
includes 975 domain labels that were not in the earlier FortiBleed dataset.

Hudson Rock's own report counts 40,573 exposed secret records in the new material.

Is this a new attack?

Not necessarily. HKCERT says most of the files carry report dates in February 2026, earlier than the material in the first investigation, so it should not be read as a new wave of attacks. The dates also do not show when the devices were actually compromised. HKCERT also stresses that the record counts do not equal the number of unique users, of credentials that still work, or of confirmed victims. Some records may belong to disabled accounts or passwords that have already been changed.

The practical point is that organisations that were not in the June list may appear in this one.

Attacks using FortiBleed data have not stopped, either. In a joint advisory on 6 October 2026, the FBI and the US Secret Service said FortiBleed operations continue to target exposed systems, citing SOCRadar's verification of more than 86,644 compromised devices across 194 countries. They warned that victims may find themselves locked out if attackers disable accounts or change passwords, and that initial access brokers have passed this access on to ransomware affiliates.

Why it matters beyond the firewall

A firewall configuration often holds the passwords the firewall uses to talk to other systems: the company directory (Active Directory), the email server, VPN user accounts and so on. If an attacker has that file, the risk is not limited to the firewall. HKCERT lists possible follow-on risks, without saying each one has happened, including logging in to the VPN or management interface, abusing directory service accounts, changing firewall rules, moving to other internal systems and installing ransomware or backdoors.

What to do now

If you, your IT vendor or a managed service provider run FortiGate devices for your business:

Check again. Search your current and past domain names on Hudson Rock's lookup page at hudsonrock.com/fortinet, which HKCERT points to, and include devices that were replaced, retired or moved to a different IP address.
Reset credentials. Change administrator, VPN and local-user passwords that are still in use, end active sessions, and change any of those passwords that were reused elsewhere.
Rotate the other secrets. Review LDAP bind and service accounts, HA, RADIUS and SMTP secrets, and, as HKCERT suggests as an extra precaution, API keys, third-party support accounts, certificates and private keys referenced in the configuration.
Turn on MFA for every administrator and remote-access account, and confirm it is actually enforced.
Close the management interface to the internet. Allow management only from trusted networks or specific IP addresses.
Review accounts and logs. Compare accounts with your approved list and the configuration with a known-good backup. Fortinet advises watching for unrecognised accounts with names such as "forticloud", "fortiuser", "fortinet-support" or "fortinet-tech-support".
Update FortiOS. Fortinet recommends supported 7.4, 7.6 or 8.0 releases, which store administrator passwords with stronger PBKDF2 hashing. Updating does not undo a leak, so the steps above still apply.
Escalate if you find anything odd. Isolate the device, keep the logs and start your incident response. You can report incidents to HKCERT at https://www.hkcert.org/incident-reporting or on its 24-hour hotline, +852 8105 6060.

A broader lesson for SMEs

FortiBleed is a reminder that leaked passwords, not only software bugs, open the door. Unique passwords, MFA everywhere, no admin pages on the open internet and least-privilege service accounts (see role-based access control and zero trust) reduce the damage when one secret leaks.

If you are unsure whether your firewall or VPN is exposed, our cybersecurity and compliance team can help review it, and our managed support service can take on ongoing patching and monitoring.

Frequently asked questions

We checked in June. Are we in the clear?

Not necessarily. HKCERT says the new dataset includes 975 domain labels that were not in the earlier FortiBleed data. Search again, including old and retired domains.

Is this a new FortiGate vulnerability?

Fortinet says FortiBleed is not a new vulnerability. It points to reused credentials and brute-force attacks on devices with weak passwords and no MFA. HKCERT adds that most FortiBleed 2.0 files are dated February 2026.

Our domain is not on the lookup page. Do we still need to act?

Yes. HKCERT calls on all organisations using Fortinet firewalls, VPNs or related appliances to reassess their exposure, and steps such as MFA, closing internet-facing management and updating FortiOS are worth doing either way.