Report · SecurityWeekAbout CVE-2026-24858Published 28 Jan 2026

Fortinet Patches Exploited FortiCloud SSO Authentication Bypass

Source SecurityWeek

Authoritative record:CVE-2026-24858· Critical 9.4

Exploited in the wild · KEV due 30 Jan 2026 · patch available : patch FortiWeb now.

Data as of 26 Oct 2026, 08:30 UTC

CVSS 3.1 base score

9.4Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 30 Jan 2026 US federal agencies must patch by this date; a sensible deadline for everyone else.
Patch: Available

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 27 Jan 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by fortinet
27 Jan 202615:11 UTC, 4 hours before disclosure
CVE published
on cve.org
27 Jan 202619:18 UTC, t = 0
In Threat Radar
record ingested
27 Jan 202619:35 UTC, 18 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
27 Jan 2026, the same day as disclosure
KEV remediation due
US federal deadline
30 Jan 2026, 3 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
FortinetFortiWeb	Affected >=8.0.0 <=8.0.3 >=7.6.0 <=7.6.6 >=7.4.0 <=7.4.11	Fixed in–
FortinetFortiNAC-F	Affected >=7.6.3 <=7.6.5	Fixed in–
FortinetFortiOS	Affected >=7.6.0 <=7.6.5 >=7.4.0 <=7.4.10 >=7.2.0 <=7.2.12 >=7.0.0 <=7.0.18	Fixed in–
FortinetFortiAnalyzer	Affected >=7.6.0 <=7.6.5 >=7.4.0 <=7.4.9 >=7.2.0 <=7.2.11 >=7.0.0 <=7.0.15	Fixed in–
FortinetFortiProxy	Affected >=7.6.0 <=7.6.4 >=7.4.0 <=7.4.12 >=7.2.0 <=7.2.15 >=7.0.0 <=7.0.22	Fixed in–
FortinetFortiManager	Affected >=7.6.0 <=7.6.5 >=7.4.0 <=7.4.9 >=7.2.0 <=7.2.11 >=7.0.0 <=7.0.15	Fixed in–

AI-suggested

European organizations should immediately verify whether their Fortinet devices are registered with FortiCloud SSO and apply the official patches released by Fortinet to remediate CVE-2026-24858. Beyond patching, organizations should implement strict access controls and multi-factor authentication (MFA) for FortiCloud accounts to reduce the risk of unauthorized access. Regularly audit FortiCloud account activity and device login logs to detect anomalous or unauthorized access attempts. Network segmentation should be employed to limit the impact of any compromised devices. Additionally, organizations should review and tighten their identity and access management policies related to cloud-based device management platforms. Employing endpoint detection and response (EDR) tools to monitor for suspicious activity on Fortinet devices can provide early warning of exploitation attempts. Finally, maintain up-to-date incident response plans that include scenarios involving cloud-based authentication bypasses.

Description

Tracked as CVE-2026-24858, the bug allows attackers to log into devices registered to other FortiCloud accounts. The post Fortinet Patches Exploited FortiCloud SSO Authentication Bypass appeared first on SecurityWeek .

Impact

For European organizations, this vulnerability poses a risk of unauthorized access to Fortinet devices managed via FortiCloud SSO. Such access could lead to compromise of network security controls, exposure of sensitive configuration data, and potential disruption of network services. Organizations in sectors such as finance, telecommunications, government, and critical infrastructure that rely heavily on Fortinet products are particularly at risk. The breach of device management credentials could facilitate further attacks, including lateral movement and data exfiltration. Given the centralized nature of FortiCloud SSO, a successful exploit could affect multiple devices across an organization, amplifying the impact. While no active exploitation is reported, the potential for targeted attacks exists, especially from threat actors seeking to compromise European networks. The impact on confidentiality and integrity is significant, though the absence of known exploits and the complexity of the attack vector reduce immediate risk. Nonetheless, the threat underscores the importance of robust identity and access management in network security.

References

securityweek.com/fortinet-patches-exploited-forticloud-sso-authentication-bypass/ (opens in a new tab)

Community reviews

Loading reviews…