CVE-2026-24858

This flaw lets someone sign in through a back door using FortiCloud SSO—without actually being allowed to access your specific device. Think of it like a club that lets people enter “through the front door,” but a mistake in the membership check could let the wrong members slip in through a side route. Once inside, an attacker may be able to view or change things they shouldn’t and help start a bigger compromise.

This matters if your business runs Fortinet network management/security products (FortiAnalyzer, FortiManager, FortiNAC-F, FortiProxy, FortiWeb, FortiOS, or Ruggedcom APE1808) and you have FortiCloud SSO enabled on those devices. The risk requires that the attacker has a FortiCloud account and a registered device, and that FortiCloud SSO is enabled on your target. In short: it’s primarily a risk to systems where FortiCloud SSO is turned on and reachable for the attacker’s FortiCloud flow—this is not about tricking a user into clicking something.

This is urgent because CISA KEV confirms the vulnerability is being used in real attacks, and reporting ties exploitation to the FortiBleed campaign. Since it is an authentication bypass connected to FortiCloud SSO, attackers can potentially access devices they shouldn’t, leading to account and configuration compromise. Apply the vendor mitigations and upgrade the affected systems immediately.

1. Confirm exposure (quick inventory):

   • Identify which Fortinet product(s) you run from this list: FortiAnalyzer, FortiManager, FortiNAC-F, FortiProxy, FortiWeb, FortiOS, and Ruggedcom APE1808.
   • Check whether each device is on an affected software version (your IT team should pull the exact version/build).
   • Check whether FortiCloud SSO authentication is enabled on those devices.

2. Determine what “fixed” means for your exact product:

   • For FortiNAC-F, the fixed version listed in the findings is 7.6.6.
   • For other affected Fortinet products, use Fortinet’s PSIRT advisory FG-IR-26-060 to get the exact upgrade targets for your branch, since the findings here only specify the FortiNAC-F fixed version.

3. Upgrade plan:

   • Schedule downtime if your environment requires it for firmware upgrades.
   • Upgrade each affected device to the fixed version(s) specified in FG-IR-26-060.
   • Validate after upgrade that FortiCloud SSO still works for legitimate users.

4. Temporary workaround if patching is delayed:

   • Follow the workaround guidance referenced by Fortinet (including the “analysis of SSO abuse on FortiOS” blog linked from PSIRT).
   • Apply the vendor-recommended mitigations immediately (FG-IR-26-060), which may include configuration changes and/or restricting the system’s exposure as instructed by the vendor.

5. CISA timeline:

   • CISA KEV remediation due date is 2026-01-30.

6. What to monitor after changes:

   • Authentication and SSO-related events around FortiCloud logins.
   • Unusual access patterns to configuration/admin interfaces.
   • Any indicators of credential reuse or abnormal activity consistent with the FortiBleed campaign.

Severity is critical, with a CVSS score of 9.8 reported in the provided context. The underlying weakness is CWE-288 (authentication bypass) caused by an alternate path/channel in how authentication is handled when FortiCloud SSO is enabled. Attack prerequisites from the findings: the attacker must have a FortiCloud account and a registered device, and FortiCloud SSO must be enabled on the target devices; no user interaction is required and authentication is bypassed for unauthorized access to other accounts’ registered devices.

Exploitation status: confirmed—this vulnerability is listed in CISA KEV (added 2026-01-27) and press/incident reporting states threat actors exploited CVE-2026-24858 as part of the FortiBleed campaign. The findings also note automated scanning/testing and credential reuse behavior in the broader campaign. No public exploit code was found in the provided findings. (A high EPSS prediction was reported, but KEV/news exploitation confirmation is treated as the primary indicator.)