CISA has added a critical Fortinet authentication‑bypass bug, tracked as CVE‑2026‑24858, to its Known Exploited Vulnerabilities (KEV) Catalog after evidence that attackers abused FortiCloud Single Sign‑On (SSO) to gain administrative access across accounts — a high‑impact event that federal agencies must remediate under BOD 22‑01 and that every enterprise running Fortinet management or gateway products should treat as an emergency patching priority. ps://www.fortiguard.com/psirt/FG-IR-26-060)
CVE‑2026‑24858 is an Authentication Bypass Using an Alternate Path or Channel (CWE‑288) that affects multiple Fortinet products when FortiCloud SSO is enabled on devices. The vulnerability allows an attacker who has a FortiCloud account and at least one registered device to authenticate to other devices tied to different FortiCloud accounts, effectively jumping account boundaries and gaining administrative control without using the target device’s credentials. Fortinet’s Product Security Incident Response Team (PSIRT) published the advisory and timeline on January 27, 2026.
This issue was serious enough that Fortinet temporarily disabled FortiCloud SSO on the cloud side to prevent further abuse and later reconfigured the service to refuse SSO requests from known vulnerable device versions; Fortinet also listed the affected releases and recommended immediate upgrades to fixed builds. Independent CVE trackers and security outlets assigned high criticality ratings (CVSS in the 9.x range) and echoed the urgent remediation guidance.
Because CISA has added the CVE to the KEV Catalog, Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive BOD 22‑01 remediation timelines. For CVEs issued since 2021, the default BOD requirement is remediation within two weeks unless CISA specifies a different timeline — turning this advisory into an operational order for federal IT teams. Private sector organizations are not legally bound by BOD 22‑01 but are strongly urged to act with the same urgency.
If you run Fortinet appliances: treat this as an immediate patch and hunt operation. Confirm your device fleet, apply Fortinet’s fixed buid SSO where needed, and hunt logs for the IoCs Fortinet provided. If you haven’t yet received or reviewed Fortinet’s PSIRT advisory, do so now — it contains the definitive version tables, workarounds and IoCs you’ll need for triage and remediation.
CISA’s KEV addition is the operational alarm bell — respond accordingly.
Caveat: some third‑party reporting indicates automated attack campaigns and partial remediation inconsistencies across Fortinet branches. Those findings are plausible and should sharpen your urgency, but verify all compromise claims against your own telemetry and against Fortinet’s published IoCs before drawing final incident conclusions. When in doubt, operate under the conservative assumption that any device matching the vulnerable‑versions table and having FortiCloud SSO enabled could be at risk until proven otherwise.
Conclusion: this is a high‑urgency, high‑impact vulnerability with real exploitation evidence. Patch, hunt, and treat the KEV listing as the operational alarm it is — for federal agencies that means compliance with BOD 22‑01 timelines, and for everyone else it means act now to avoid a rapid, automated compromise.
Source: CISA CISA Adds One Known Exploited Vulnerability to Catalog | CISA
Background / Overview
CVE‑2026‑24858 is an Authentication Bypass Using an Alternate Path or Channel (CWE‑288) that affects multiple Fortinet products when FortiCloud SSO is enabled on devices. The vulnerability allows an attacker who has a FortiCloud account and at least one registered device to authenticate to other devices tied to different FortiCloud accounts, effectively jumping account boundaries and gaining administrative control without using the target device’s credentials. Fortinet’s Product Security Incident Response Team (PSIRT) published the advisory and timeline on January 27, 2026. This issue was serious enough that Fortinet temporarily disabled FortiCloud SSO on the cloud side to prevent further abuse and later reconfigured the service to refuse SSO requests from known vulnerable device versions; Fortinet also listed the affected releases and recommended immediate upgrades to fixed builds. Independent CVE trackers and security outlets assigned high criticality ratings (CVSS in the 9.x range) and echoed the urgent remediation guidance.
Because CISA has added the CVE to the KEV Catalog, Federal Civilian Executive Branch (FCEB) agencies must follow Binding Operational Directive BOD 22‑01 remediation timelines. For CVEs issued since 2021, the default BOD requirement is remediation within two weeks unless CISA specifies a different timeline — turning this advisory into an operational order for federal IT teams. Private sector organizations are not legally bound by BOD 22‑01 but are strongly urged to act with the same urgency.
What exactly is the flaw?
How the vulnerability works (high level)
- The root problem is an SSO authentication context isolation failure: FortiCloud SSO sessions and device registrations were not strictly isolated by account in certain product builds, allowing a valid FortiCloud session tied to one account (and device) to be accepted by another device that had FortiCloud SSO enabled.
- Practically, an attacker with a FortiCloud account and a registered device could initiate an SSO flow against a target device and be granted administrative access even though the attacker did not possess the target device’s credentials or local accounts. This is a classic alternate path bypass: the product provides a privileged authentication channel that does not properly validate that the channel belongs to the claimed account.
Affected products and versions (vendor guidance)
Fortinet’s PSIRT lists affected families and the minimum fixed releases admins should target to fully remediate the issue. Key affected product families and the ranges Fortinet called out include:- FortiOS: vulnerable in a range of 7.6, 7.4, 7.2, and 7.0 builds; Fortinet recommends upgrading to fixed releases (for example, 7.6.6+, 7.4.11+, 7.2.13+, 7.0.19+ depending on branch).
- FortiManager and FortiAnalyzer: analogous vulnerable ranges in 7.6, 7.4, 7.2, and 7.0 that require upgrades to the corresponding patched builds.
- FortiProxy, FortiWeb, and FortiSwitch Manager were identified as under investigation for related or similar issues.
Why this is worse than a routine login bug
Authentication‑bypass vulnerabilities are high‑value targets for attackers because they eliminate the need to guess or steal credentials and can instantly elevate the attacker’s privileges to administrative levels. CVE‑2026‑24858 is particularly dangerous for several reasons:- Remote and low‑complexity attack vector: The weakness can be triggered remotely over the network and, according to public advisories and trackers, requires no privileges on the target device other than that the device has FortiCloud SSO enabled. That combination reduces attacker friction dramatically.
- Administrative control leads to fast follow‑on activities: Once an attacker gains admin access, common post‑exploitation steps include exporting configuration backups (which often contain VPN credentials and certificates), creating persistent local admin accounts, disabling logging, or staging a configuration‑level backdoor. Fortinet’s advisory documents precisely these observed attacker behaviors (config exfiltration and rogue admin account creation).
- Cross‑account scope: Unlike a single device compromise, this flaw permits cross‑account compromise — meaning an attacker with relatively limited presence can abuse the FortiCloud trust model to pivot between unrelated tenants. That is a multiplied risk for managed service providers (MSPs), multi‑tenant environments, and customers that register many devices to a single central service.
Evidence of active exploitation — what Fortinet found
Fortinet reported active exploitation of the SSO bypass in the wild. Their PSIRT timeline includes the following operational details:- Fortinet observed the malicious activity from two FortiCloud accounts and locked those accounts on January 22, 2026.
- Fortinet disabled FortiCloud SSO at the cloud side on January 26, 2026 to prevent further abuse; the service was later reconfigured on January 27, 2026 to reject SSO logins from devices running vulnerable product builds.
Cross‑checking public trackers and vendors
Multiple independent sources corroborate the existence and scope of CVE‑2026‑24858:- Fortinet’s official PSIRT advisory provides vendor‑verified details, version tables, IoCs, and remediation instructions — the primary source for actionable patching information.
- Public CVE aggregators and trackers list CVE‑2026‑24858 with high base scores and reproduce the affected product ranges noted by Fortinet, confirming the community classification and severity. These trackers also reference the CISA KEV catalog as a distribution point for the KEV listing.
- Security outlets and rapid‑response blogs (which should be treated cautiously) reported observed exploit campaigns and advised immediate disabling of FortiCloud SSO where upgrades could not be performed immediately. Those reports amplify the urgency but should be verified against your own telemetry and Fortinet’s advisory.
Immediate action checklist — what to do now
If your organization operates Fortinet devices that could use FortiCloud SSO (FortiGate/FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, FortiWeb), take these steps immediately:- Inventory and identify: Enumerate all Fortinet devices, recorded firmware/OS versions, and which devices have FortiCloud SSO enabled. Prioritize internet‑facing and management‑plane reachable appliances. (Use configuration exports and management consoles to confirm SSO toggle state.)
- Isolate and contain: For high‑risk, internet‑exposed devices where you cannot immediately upgrade, consider disabling FortiCloud SSO on the device (config system global → set admin‑forticloud‑sso‑login disable) and restrict admin access to management networks. Fortinet’s advisory notes that disabling the SSO toggle on the client side is an available workaround.
- Patch to fixed builds: Apply vendor‑recommended upgrades to the fixed releases for your product branch as published by Fortinet. Confirm successful upgrade and validate SSO behavior only after you are on a non‑vulnerable version. Refer to Fortinet’s PSIRT version matrix for the precise upgrade targets.
- Hunt for compromise: Search logs for suspicious SSO login attempts, the IoC usernames Fortinet listed, the IP addresses in their advisory, and for newly created local admin accounts with names matching common persistence labels. If you find evidence of unauthorized access, follow your incident response playbook for containment, credential rotation, forensic collection, and notification.
- Rotate secrets and credentials: If you suspect an appliance was accessed, assume the configuration and any credentials or certificates stored on it may be compromised and rotate them. This includes VPN credentials, PSK material, and API tokens.
- Document and report: Federal agencies must follow BOD 22‑01 reporting and remediation timelines; non‑federal entities should still document remediation steps, threat findings, and any communications with Fortinet or third‑party MSSPs.
Detection guidance: what logs and alerts to monitor
- Admin login events: Review web/GUI and SSO login logs for anomalous FortiCloud SSO events, especially from unknown FortiCloud usernames or the IP addresses Fortinet enumerated. Correlate SSO events with subsequent actions such as configuration download or admin account creation.
- Config export and backup activity: Watch for immediate or unexpected configuration exports (export/backup operations) after an SSO login — attackers often exfiltrate configs first to harvest secrets and credentials.
- Local account additions: Alert on creation of new local admin accounts, particularly with low‑entropy or management‑style names. Compare against your known admin list.
- Unusual policy changes or logging endpoints: Attackers frequently alter logging or telemetry endpoints to cover tracks; monitor for changes to syslog/NTP/remote management settings and compare with change management records.
Operational and policy implications
For federal agencies (BOD 22‑01 compliance)
- CISA’s addition of the CVE to the KEV Catalog makes remediation a mandated activity under BOD 22‑01. For CVEs identified after 2021, the typical remediation window is two weeks unless CISA specifies otherwise. This deadline drives prioritization across agency vulnerability management programs and must be reflected in patch‑management tickets, CDM dashboard updates, and reporting. Failure to comply invites escalated oversight and potential operational restrictions.
For enterprises and MSPs
- Organizations that operate multi‑tenant or managed Fortinet infrastructure must treat this as a potential supply‑chain and multi‑tenant risk. MSPs that register customer devices to a central FortiCloud account should immediately confirm that all customer devices are on patched builds or that SSO is disabled until they can upgrade.
- If you use centralized device registration or remote management, review internal policies that permit onboarding via third‑party cloud accounts and require additional verification (device attestation, allowlists, MFA for management functions).
Critical strengths and remaining risks — a balanced assessment
Notable strengths of the response so far
- Timely vendor disclosure and mitigation: Fortinet published a PSIRT advisory with version tables, IoCs, and an operational timeline within days of observed exploitation; that transparency helps defenders act fast.
- Cloud‑side emergency controls: Fortinet’s temporary disablement and subsequent hardening of FortiCloud SSO demonstrate an active containment posture that reduced immediate attacker opportunity while patches were prepared.
- CISA KEV listing accelerates federal urgency: The KEV catalog entry shortens agency remediation timelines and signals to the broader ecosystem that this is a real, observed threat that should be prioritized.
Remaining and latent risks
- Incomplete mitigation coverage in mixed inventories: Organizations running a mix of Fortinet branches (7.0/7.2/7.4/7.6) need targeted upgrade paths; upgrade windows that require staged rollouts leave gaps an attacker can exploit. Fortinet’s advisory does provide per‑branch targets, but operational constraints mean the attack surface may remain until upgrades complete.
- Potential for rapid automated exploitation: Reports from third parties indicate attackers have automated the compromise pattern (scripted SSO login → config export → account creation). Automated campaigns can compromise devices in seconds once exploit code or tooling spreads. Treat such reports as credible and prioritize network‑facing and management interfaces accordingly, while validating against your telemetry.
- Residual trust in cloud‑managed pathways: The root cause — trust between a cloud service and in‑field devices — is architectural. Even after patches, organizations must rethink default enablement of remote SSO and the governance surrounding account registration and multi‑tenant control planes.
Longer‑term recommendations for vulnerability management
- Adopt a policy that treats KEV catalog additions as escalation events in your vulnerability management lifecycle: triage to emergency, assign an owner, allocate maintenance windows, and track to closure with evidence. CISA’s BOD 22‑01 formalizes this for federal agencies and provides a useful model for private sector programs.
- Harden management planes by default: require explicit opt‑in for cloud SSO features, enforce management network allowlists, and require per‑device MFA or out‑of‑band attestation before enabling remote administrative features.
- Improve telemetry around configuration events: centralize logging of admin actions, config exports, and account creations, and tune detection rules for the behavior patterns observed in Fortinet’s IoCs.
- Build rollback and recovery playbooks for network security devices: ensure you can isolate and fully reprovision a compromised device quickly, rotate keys and certificates, and re-establish secure management connectivity with new credentials.
What to tell executives and customeirect: explain that CISA has listed CVE‑2026‑24858 in the KEV Catalog and Fortinet reported active exploitation that allowed administrative takeover via FortiCloud SSO. Reference Fortinet’s advisory and CISA’s KEV addition as the authoritative notices driving immediacy.
- Communicate impact and remediation status: identify which business services rely on affected appliances, state whether FortiCloud SSO is enabled, list the mitigation performed (SSO disabled, patch applied, accounts rotated), and set expectations for ongoing monitoring and forensic work if compromise was suspected.
- For managed customers, provide clear guidance and deadlines: if devices are managed on their behalf, give them a timeline for when their devices will be patched and what compensations or temporary mitigations have been applied.
Final verdict: act like this is an incident
CVE‑2026‑24858 is not a theoretical defect — vendor telemetry shows exploitation, Fortinet took emergency cloud‑side action, and CISA’s KEV listing turns the advisory into a compliance‑level priority for federal agencies. The combination of remote exploitability, no privileges required, and administrative impact elevates this to an incident‑class event for any organization with susceptible devices or FortiCloud SSO enabled.If you run Fortinet appliances: treat this as an immediate patch and hunt operation. Confirm your device fleet, apply Fortinet’s fixed buid SSO where needed, and hunt logs for the IoCs Fortinet provided. If you haven’t yet received or reviewed Fortinet’s PSIRT advisory, do so now — it contains the definitive version tables, workarounds and IoCs you’ll need for triage and remediation.
CISA’s KEV addition is the operational alarm bell — respond accordingly.
Quick reference (actionable summary)
- Vulnerability: CVE‑2026‑24858 — FortiCloud SSO cross‑account authentication bypass (CWE‑288).
- Source/vendor advisory: Fortinet PSIRT FG‑IR‑26‑060 (published Jan 27, 2026) — version matrix, IoCs, workarounds.
- Federal action: CISA added the CVE to the KEV Catalog, invoking BOD 22‑01 remediation expectations for federal agencies.
- Immediate steps: inventory → disable SSO (if necessary) → upgrade to Fortinet fixed builds → hunt for IoCs → rotate credentials → report/close tickets.
Caveat: some third‑party reporting indicates automated attack campaigns and partial remediation inconsistencies across Fortinet branches. Those findings are plausible and should sharpen your urgency, but verify all compromise claims against your own telemetry and against Fortinet’s published IoCs before drawing final incident conclusions. When in doubt, operate under the conservative assumption that any device matching the vulnerable‑versions table and having FortiCloud SSO enabled could be at risk until proven otherwise.
Conclusion: this is a high‑urgency, high‑impact vulnerability with real exploitation evidence. Patch, hunt, and treat the KEV listing as the operational alarm it is — for federal agencies that means compliance with BOD 22‑01 timelines, and for everyone else it means act now to avoid a rapid, automated compromise.
Source: CISA CISA Adds One Known Exploited Vulnerability to Catalog | CISA
