CVE-2026-24858: FortiCloud SSO cross-account authentication bypass
Tech GuruQuick Answer
CVE-2026-24858 allows cross-account administrative login when the target uses FortiCloud SSO and the attacker has a FortiCloud account with a registered device. SSO is off at factory default but can be enabled during FortiCare registration. Check the expanded product table below, preserve administrator and configuration-download evidence, and update. Fortinet's cloud-side block is not an appliance patch or proof of recovery.
Fix Or Immediate Action
What to do now: Confirm whether FortiCloud SSO is enabled, apply the product-specific fixed build for FortiAnalyzer, FortiManager, FortiOS, or FortiProxy, and review administrators, configuration downloads, and account-boundary activity.
Evidence check: Vendor evidence and unresolved limits are described below. CISA KEV catalog 2026.10.02 was checked October 2. Catalog additions, vendor publication dates and update releases are separate events. No exploit, installation or recovery test is claimed.
Context
Scope And Impact In Plain Language
Who should check: Anyone who manages Fortinet Multiple Products.
When this applies: Only when the exact product, version, and required configuration match the live vendor advisory. Owning the product family alone does not mean the device is vulnerable.
What could happen: An attacker may be able to get past a sign-in or trust check and reach functions they should not be allowed to use.
Not sure? Find the product name and version in the device or application, then compare them with the affected-products section of the linked vendor notice.
Status At A Glance
| Product scope | Fortinet — Multiple Products |
|---|---|
| CVE | CVE-2026-24858 |
| TechGeeks response tier | P0 — confirm an exact match and act now |
| CISA KEV added | 2026-01-27 |
| Vendor severity | Critical (FG-IR-26-060). |
| CVSS | 9.4 (vendor CVSS v3.1 base). |
| Ransomware field | Unknown — this is not the same as No; CISA has not marked the field Known. |
| Forensic-triage field | No in the current CISA field; organizations should still investigate when exposure or evidence warrants it. |
| CWE | CWE-288 |
| Federal remediation date | 2026-01-30 — applies to covered federal agencies; other organizations should set a risk-based deadline. |
What Happened
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability. Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. CISA's KEV listing confirms exploitation evidence, but it does not state how widespread the activity is or prove that any particular installation was compromised.
Affected Scope
Fortinet additionally lists FortiSwitchManager and FortiWeb; its table also includes FortiNAC-F, which the summary omits. Custom-IdP SSO, including FortiAuthenticator, and FortiManager Cloud, FortiAnalyzer Cloud and FortiGate Cloud are excluded. Match the exact product, branch and FortiCloud SSO setting.
Match the exact edition, hardware or virtual platform, release, patch level, enabled feature, and management exposure. A product-family name alone is not enough to establish applicability.
Steps
What To Do Now
- Confirm. Inventory every Multiple Products asset and record its exact version, patch level, role, relevant configuration, and exposure.
- Preserve. Save UTC timestamps, off-device authentication, firewall, proxy, DNS, endpoint, application, and SIEM evidence before logs rotate or a disruptive change removes context.
- Contain. Restrict unnecessary internet and management-plane access using supported controls. Follow the live advisory: Open the live Fortinet advisory.
- Remediate. Confirm whether FortiCloud SSO is enabled, apply the product-specific fixed build for FortiAnalyzer, FortiManager, FortiOS, or FortiProxy, and review administrators, configuration downloads, and account-boundary activity.
- Validate. Verify the resulting version or patch level, service health, logging, expected access, an expected denial, and representative dependent workflows.
- Escalate. If exposure overlapped the vulnerable period or evidence is suspicious, treat the system as a potential incident and follow vendor and incident-response recovery guidance.
Fixed Releases And Mitigation
Permanent Fix
Use the listed branch fix or a later supported release through Fortinet's approved upgrade path; identical branch numbers across products do not mean identical fixes.
| Product | Branch: fixed release |
|---|---|
| FortiAnalyzer / FortiManager | 7.6: 7.6.6; 7.4: 7.4.10; 7.2: 7.2.12; 7.0: 7.0.16 |
| FortiNAC-F | 7.6.3-7.6.5 affected: 7.6.6 |
| FortiOS | 7.6: 7.6.6; 7.4: 7.4.11; 7.2: 7.2.13; 7.0: 7.0.19 |
| FortiProxy | 7.6: 7.6.5; 7.4: 7.4.13; 7.2: 7.2.16; 7.0: 7.0.23 |
| FortiSwitchManager | 7.2: 7.2.9; 7.0: 7.0.8 |
| FortiWeb | 8.0: 8.0.4; 7.6: 7.6.7; 7.4: 7.4.12 |
Workaround Or Temporary Mitigation
Fortinet disabled FortiCloud SSO January 26 and re-enabled it January 27 while rejecting vulnerable devices. It says local disabling is no longer necessary for that block. Local disabling remains optional under its product-specific procedure; verify alternate administrator access before changing SSO. Upgrade to restore supported SSO operation.
Important boundary: A workaround, access restriction, or provider-side control may reduce risk while the update is prepared, but it does not necessarily remove vulnerable code or erase an earlier compromise. Install the vendor-approved update when one is available.
Investigation And Recovery
Review all administrator accounts, configuration downloads and SSO activity, not only Fortinet's named indicators: attacker account names and IPs can change. CISA's forensic-triage field is not a clean-system attestation.
When an attacker may have gained administrative, root, SYSTEM, identity, management-plane, or code-execution access, patching alone is not an eradication claim. Preserve evidence, scope affected accounts and downstream systems, rotate exposed credentials or certificates when justified, and rebuild from a trusted source when vendor or incident-response guidance requires it.
Notes
Exploitation Evidence
Vendor statement: Fortinet reports exploitation/SSO abuse associated with this issue.
CISA statement: CVE-2026-24858 was added to KEV on 2026-01-27. The ransomware field is Unknown, and the forensic-triage field is No. These are separate signals.
Validation And Boundaries
This notice does not prove that every product carrying the family name is affected, that exploitation is widespread, that a clean indicator search rules out compromise, or that a successful update restored trust. TechGeeks has not reproduced the exploit and does not replace the vendor advisory, asset inventory, vulnerability scanner, or incident-response process.
Related TechGeeks Resources
- TechGeeks Security Notice Center
- All Security Notices
- What to Do When a Device Hits CISA KEV
- Router CVE Exposure, Version, and Mitigation Checklist
- IoT Firmware Update and End-of-Support Checklist
- Live Protect and Runtime Vulnerability Shielding
References
Wrap-Up
Record whether CVE-2026-24858 applies to your environment. If it does, assign an owner, preserve the change and investigation evidence, complete the vendor action, and document the validated result.
Correction policy: If a primary source changes affected versions, remediation, exploitation status, or recovery guidance, TechGeeks will update this page and its verification date.
