CVE-2026-24858: 
FortiOS vulnerability analysis and mitigation

CVE-2026-24858 is a critical Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) affecting multiple Fortinet products. It allows an attacker with any valid FortiCloud account and a registered device to authenticate to other organizations' devices if FortiCloud SSO is enabled. Affected products include FortiOS 7.0.0–7.0.18, 7.2.0–7.2.12, 7.4.0–7.4.10, 7.6.0–7.6.5; FortiManager 7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5; FortiAnalyzer (same ranges); FortiProxy 7.0.0–7.0.22, 7.2.0–7.2.15, 7.4.0–7.4.12, 7.6.0–7.6.4; FortiWeb 7.4.0–7.4.11, 7.6.0–7.6.6, 8.0.0–8.0.3; and FortiNAC-F 7.6.3–7.6.5. Fortinet first identified active exploitation on January 22, 2026, and published the advisory on January 27, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (FortiGuard Advisory, CISA KEV).

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The FortiCloud SSO feature, when enabled, allows administrative login via SAML assertions from FortiCloud. The flaw permits an attacker holding any valid FortiCloud account to authenticate to Fortinet devices registered under entirely different customer accounts — effectively bypassing tenant isolation in the SSO flow. FortiCloud SSO is not enabled by default, but is automatically activated when an administrator registers a device to FortiCare via the GUI unless the 'Allow administrative login using FortiCloud SSO' toggle is explicitly disabled. The vulnerability does not affect setups using custom third-party SAML IdPs or FortiAuthenticator. Multiple public PoC exploits have been published on GitHub (FortiGuard Advisory, Fortinet Blog).

Successful exploitation grants attackers full super-admin access to victim Fortinet security appliances — including firewalls, network managers, log analyzers, proxies, and web application firewalls — belonging to organizations other than the attacker's own. Observed post-exploitation activity includes downloading device configuration files, creating persistent local backdoor administrator accounts, inspecting network traffic, and enabling lateral movement into internal networks including Active Directory environments. The breadth of affected products and the administrative-level access obtained make this vulnerability particularly severe, with potential for data exfiltration, network traffic interception, and complete infrastructure compromise across multiple organizations (FortiGuard Advisory, Fortinet Blog, SentinelOne).

CVE-2026-24858 was actively exploited in the wild as a zero-day before public disclosure, with Fortinet identifying two malicious FortiCloud accounts conducting attacks as early as January 22, 2026. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on January 27, 2026, with a remediation due date of January 30, 2026. At least four public proof-of-concept exploits have been published on GitHub. The EPSS score is approximately 0.037. Post-exploitation activity has been linked to coordinated campaigns using Cloudflare-protected IP addresses, with attackers creating persistent backdoor local admin accounts and exfiltrating configurations. SentinelOne and other threat intelligence firms have documented follow-on intrusions including Active Directory compromise stemming from FortiGate exploitation (CISA KEV, FortiGuard Advisory, SentinelOne).

1. Reconnaissance: Identify internet-facing Fortinet devices (FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb) with FortiCloud SSO enabled using tools like Shodan or Censys, targeting vulnerable version ranges.
2. Obtain a FortiCloud account: Register any legitimate FortiCloud account and register at least one Fortinet device to it — this is the only prerequisite for exploitation.
3. Initiate SSO authentication: Trigger a FortiCloud SSO login request against a target device belonging to a different organization. The vulnerability in the SSO path allows the attacker's FortiCloud credentials to be accepted by devices registered to other accounts.
4. Gain super-admin access: Upon successful authentication bypass, the attacker is granted super-admin privileges on the victim device, equivalent to a full administrative session.
5. Establish persistence: Create a local administrator account using names such as 'audit', 'backup', 'itadmin', 'secadmin', 'support', 'backupadmin', 'remoteadmin', or 'securitysvcadmin' to maintain access even if the SSO account is disabled.
6. Exfiltrate configuration and pivot: Download the device configuration file (containing credentials, VPN settings, LDAP/AD integration details), then use harvested service account credentials to move laterally into the victim's internal network and Active Directory environment (FortiGuard Advisory, Fortinet Blog, SentinelOne).

• Network: Inbound SSO login attempts from Cloudflare-protected IP ranges (104.28.244.115, 104.28.212.114, 104.28.212.115, 104.28.195.105/106, 104.28.227.105/106, 104.28.244.114, 163.61.198.15, 38.54.6.28); additional attacker IPs: 37[.]1.209.192, 17[.]119.139.50.
• Logs: FortiOS event log entries with logid="0100032001", method="sso", status="success" from unexpected FortiCloud email accounts such as cloud-noc@mail.io, cloud-init@mail.io, heltaylor.12@tutamail.com, support@openmail.pro; log pattern: ui="sso(<IP>)" with profile="super_admin".
• Logs (account creation): Event log entries with logid="0100044547", action="Add", cfgpath="system.admin" showing creation of accounts named: audit, backup, itadmin, secadmin, support, backupadmin, deploy, remoteadmin, securitysvcadmin, system, adccount.
• File System / Configuration: Unexpected entries in the device administrator list; unauthorized changes to VPN configuration or LDAP/AD-connected accounts; configuration files downloaded without authorization.
• Process / Behavior: Unexpected administrative GUI sessions from external IPs; configuration changes made by SSO-authenticated accounts not belonging to the organization's own FortiCloud tenant (FortiGuard Advisory, Fortinet Blog).

Fortinet has released patched versions for all affected products. Upgrade targets are: FortiOS 7.0.19+, 7.2.13+, 7.4.11+, 7.6.6+; FortiManager 7.0.16+, 7.2.12+, 7.4.10+, 7.6.6+; FortiAnalyzer 7.0.16+, 7.2.12+, 7.4.10+, 7.6.6+; FortiProxy 7.0.23+, 7.2.16+, 7.4.13+, 7.6.5+; FortiWeb 7.4.12+, 7.6.7+, 8.0.4+; FortiNAC-F 7.6.6+; FortiSwitchManager 7.0.8+, 7.2.9+. As an immediate workaround, disable FortiCloud SSO: on FortiOS/FortiProxy, navigate to System → Settings and set 'Allow administrative login using FortiCloud SSO' to Off, or run config system global / set admin-forticloud-sso-login disable / end; on FortiManager/FortiAnalyzer, go to System Settings → SAML SSO and disable 'Allow admins to login with FortiCloud'. Additionally, audit all administrator accounts for unexpected entries, rotate any credentials that may have been exposed, and restrict administrative interface access to trusted IP ranges using local-in policies. CISA mandated federal agencies patch by January 30, 2026 (FortiGuard Advisory, CISA KEV).

Fortinet's PSIRT published a detailed advisory and a companion blog post authored by Carl Windsor on January 27, 2026, disclosing the timeline of events including the January 22 discovery, January 26 temporary disabling of FortiCloud SSO globally, and January 27 restoration with version-gating. CISA issued its own guidance alert on January 28, 2026, urging immediate action. Security vendors including Arctic Wolf, eSentire, SentinelOne, Kaspersky, and SOCRadar published threat advisories and detection guidance. BleepingComputer, The Hacker News, SecurityWeek, The Register, and CyberScoop provided broad media coverage. Community discussion on Reddit (r/fortinet, r/cybersecurity, r/SecOpsDaily) was active, with practitioners expressing frustration at the recurring nature of Fortinet SSO-related vulnerabilities. The H-ISAC issued a TLP:WHITE threat bulletin for healthcare sector organizations. Kaspersky published SIEM detection rules specifically for this vulnerability (Fortinet Blog, CISA KEV, BleepingComputer).