# Fort Smith, Arkansas exposed via FortiBleed VPN credentials

Published: 2026-09-15 · Severity: elevated · Sectors: government-national
Canonical: https://vorant.io/reports/df654bd6-5ba9-5144-a04a-51fb68ed7358/fort-smith-arkansas-exposed-via-fortibleed-vpn-credentials

> City of Fort Smith had FortiOS SSL-VPN credentials exposed in FortiBleed leak; 39 compromised accounts identified.

The City of Fort Smith, Arkansas was identified as a victim through the FortiBleed vulnerability (CVE-2022-40684), which exposed FortiOS SSL-VPN credentials. Security research identified 39 compromised user accounts associated with the city's domain, along with 15 items on the external attack surface. While the article does not detail an active ransomware deployment, it documents credential exposure that could enable lateral movement and unauthorized access to municipal systems. The exposure was disclosed through public ransomware tracking platforms and represents a significant risk to the municipality's IT infrastructure, particularly given SSL-VPN access typically grants broad network privileges. This case exemplifies how credential leaks from infrastructure vulnerabilities create downstream compromise risks.

## Mentioned in this report

- Vulnerabilities: CVE-2022-40684 (KEV)

## Detection guidance (public sample)

### FortiGate SSL-VPN Login Failure Burst Indicative of Brute Force

ATT&CK: T1110

FortiGate SSL-VPN login failure events; alert when many occur for one user or source in a short window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiGate SSL-VPN Login Failure Burst Indicative of Brute Force
description: Detects FortiGate SSL-VPN login failure events. Individual events are
  low signal; tune the SIEM to alert when a single source IP or many usernames produce
  a high number of failures within a few minutes (password guessing or spraying against
  exposed VPN accounts).
tags:
- attack.credential-access
- attack.t1110
logsource:
  product: fortigate
  service: event
detection:
  selection:
    logdesc|contains: SSL VPN login fail
  selection_action:
    action: ssl-login-fail
  condition: 1 of selection*
falsepositives:
- Users mistyping passwords or using expired credentials after a password change
- Misconfigured VPN clients retrying with stale saved credentials
level: medium
id: 218e8ab8-1dee-5126-995c-72797fdb6110
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==
```

### FortiOS Admin API Auth Bypass Attempt (CVE-2022-40684 Pattern)

ATT&CK: T1078.001

HTTP PUT to the FortiOS admin cmdb API with the Report Runner user agent, the known CVE-2022-40684 auth bypass pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS Admin API Auth Bypass Attempt (CVE-2022-40684 Pattern)
description: Detects HTTP requests to the FortiOS cmdb admin API using the Report
  Runner user agent, a known CVE-2022-40684 authentication bypass pattern. It is used
  to modify admin accounts (for example adding an SSH key) and expose or abuse VPN
  credentials.
tags:
- attack.initial-access
- attack.t1078.001
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-user-agent|contains: Report Runner
    cs-uri-stem|contains: /api/v2/cmdb/system/admin
  selection_method:
    cs-method:
    - PUT
    - POST
  condition: selection and selection_method
falsepositives:
- Authorised vulnerability scanners probing for CVE-2022-40684
level: high
id: d52d8c92-059a-5a5b-933e-ece56dfc2f9d
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==
```

### FortiGate SSL-VPN Tunnel Established by Default or Generic Account Name

ATT&CK: T1078.001

SSL-VPN tunnel established under a default or generic account name such as admin, administrator, guest or test. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiGate SSL-VPN Tunnel Established by Default or Generic Account Name
description: Detects successful FortiGate SSL-VPN tunnel establishment by default
  or generic account names (admin, administrator, guest, test). Such accounts are
  rarely legitimate VPN users and suggest use of leaked or default credentials for
  trusted-relationship style access.
tags:
- attack.initial-access
- attack.t1078.001
- attack.t1199
logsource:
  product: fortigate
  service: event
detection:
  selection:
    logdesc|contains: SSL VPN tunnel up
    user:
    - admin
    - administrator
    - guest
    - test
    - user
  condition: selection
falsepositives:
- Lab or test FortiGate deployments that deliberately use generic VPN accounts
- Administrators temporarily testing VPN connectivity with a default account
level: medium
id: 884a2ecd-12c1-54fa-8857-ed91309d90d7
status: experimental
author: Vorant
references:
- https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/Q2l0eSBvZiBGb3J0IFNtaXRoIEFya2Fuc2FzQGludGVybG9jaw==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/df654bd6-5ba9-5144-a04a-51fb68ed7358/fort-smith-arkansas-exposed-via-fortibleed-vpn-credentials.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup