Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-24858 | FortiCloud SSO Authentication Bypass Across Multiple Fortinet Products CVE-2026-24858 is an authentication bypass (CWE-288) in FortiCloud single sign-on that lets an attacker who owns a FortiCloud account with any registered device log in to other customers' Fortinet devices that have FortiCloud SSO authentication enabled. It affects a wide range of 7.x/8.x builds of FortiOS, FortiProxy, FortiWeb, FortiAnalyzer, FortiManager, FortiNAC-F, and the Siemens RUGGEDCOM APE 1808. An attacker gains unauthorized access to devices registered to other accounts, and related reporting describes FortiGate devices being exploited to breach networks and steal service account credentials. Any organization running an affected build with FortiCloud SSO enabled is exposed. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2026-01-27 and Fortinet patched it after active FortiOS SSO exploitation was detected, and EPSS assigns an 86.1% probability of exploitation within 30 days. Do: Upgrade all affected Fortinet products to the fixed releases specified in Fortinet's PSIRT advisory for CVE-2026-24858; as an interim mitigation, disable FortiCloud SSO authentication on affected devices and audit which devices are registered to your FortiCloud account. Review device logs for unexpected administrative logins or signs of service-account credential theft on FortiGate, and federal agencies must apply mitigations per BOD 22-01 (including CISA's cloud services guidance) or discontinue use of the product. | 9.8 | 86% | KEV |
| masshundreds of thousands of devices potentially affected (Fortinet's FortiGate install base is in the millions and public internet scans have long shown hundreds… |
Full article576 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 28, 2026Network Security / Zero-Day
Fortinet has begun releasing security updates to address a critical flaw impacting FortiOS that has come under active exploitation in the wild.
The vulnerability, assigned the CVE identifier CVE-2026-24858 (CVSS score: 9.4), has been described as an authentication bypass related to FortiOS single sign-on (SSO). The flaw also affects FortiManager and FortiAnalyzer. The company said it's continuing to investigate if other products, including FortiWeb and FortiSwitch Manager, are impacted by the flaw.
"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS, FortiManager, FortiAnalyzer may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices," Fortinet said in an advisory released Tuesday.
It's worth noting that the FortiCloud SSO login feature is not enabled in the default factory settings. It's only turned on in scenarios where an administrator registers the device to FortiCare from the device's GUI, unless they have taken steps to explicitly toggle the "Allow administrative login using FortiCloud SSO" switch.
The development comes days after Fortinet confirmed that unidentified threat actors were abusing a "new attack path" to achieve SSO logins without requiring any authentication. The access was abused to create local admin accounts for persistence, make configuration changes granting VPN access to those accounts, and exfiltrate those firewall configurations.
Over the past week, the network security vendor said it has taken the following steps -
- Locked out two malicious FortiCloud accounts ([email protected] and [email protected]) on January 22, 2026
- Disabled FortiCloud SSO on the FortiCloud side on January 26, 2026
- Re-enabled FortiCloud SSO on January 27, 2026, while disabling the option to login from devices running vulnerable versions
In other words, customers are required to upgrade to the latest versions of the software for the FortiCloud SSO authentication to function. Fortinet is also urging users who detect signs of compromise to treat their devices as breached and recommends the following actions -
- Ensure the device is running the latest firmware version
- Restore configuration with a known clean version or audit for any unauthorized changes
- Rotate credentials, including any LDAP/AD accounts that may be connected to the FortiGate devices
The development has led the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-24858 to its Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to remediate the issues by January 30, 2026.
Update
On January 28, 2026, CISA issued additional guidance for CVE-2026-24858, noting that it allows "malicious actors with a FortiCloud account and a registered device to log in to separate devices registered to other users in FortiOS, FortiManager, FortiWeb, FortiProxy, and FortiAnalyzer, if FortiCloud single sign-on (SSO) is enabled on devices."
Customers of FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb are all affected and should upgrade to the latest version to restore FortiCloud SSO services.
Fortinet is still investigating FortiSwitch Manager for its exposure to the security flaw. The company has since confirmed that the issue only impacts FortiCloud SSO and does not affect third-party SAML IdP or FortiAuthenticator implementations.
The agency is also urging users to "check for indicators of compromise on all internet-accessible Fortinet products affected by this vulnerability and immediately apply updates as soon as they are available using Fortinet's instructions."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/01/fortinet-patches-cve-2026-24858-after.html