{"id":"fortinet-forticloud-sso-bypass-jan-2026","category":"patch","status":"closed","title":"Fortinet FortiCloud SSO login bypass CVE-2026-24858 exploited; fixes available","tldr":"Attackers used FortiCloud single sign-on to take over other customers’ Fortinet devices and steal configurations. Fixes now cover all affected branches. Ask your IT provider to update and investigate earlier access; patching alone does not clean up a compromise.","summary":"CVE-2026-24858 let someone with their own FortiCloud account and registered device gain administrative access to another customer's vulnerable device when FortiCloud single sign-on was enabled. It affects FortiGate firewalls running FortiOS and several Fortinet management, proxy and security products. Attackers stole device configurations and created administrator accounts to retain access, including on firewalls updated against earlier SSO flaws. Fortinet temporarily stopped cloud SSO, then restored it with vulnerable firmware blocked. Its current advisory names fixes for every affected branch; Siemens also provides an update path for affected RUGGEDCOM installations. Custom identity providers are unaffected. Previously compromised devices still require investigation, configuration recovery and credential changes. The sources reviewed do not establish a final victim count or that all intrusions have been cleaned up. Fortinet displays a severity score of 9.4; Siemens lists 9.8.","action":"If your home office, family office or business uses Fortinet equipment, ask its IT provider to install the applicable fixed release below or a later supported version. Have them check for unexpected administrators and configuration changes; if compromised, restore or audit the configuration and rotate exposed credentials, including connected directory accounts.","product":"Fortinet FortiGate/FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiSwitchManager and FortiNAC-F","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-24858"],"tags":["fortinet","fortigate","forticloud","authentication-bypass","zero-day","firewall"],"affected":["The following Fortinet versions are affected when FortiCloud SSO authentication is enabled.","FortiOS: 7.6.0–7.6.5; 7.4.0–7.4.10; 7.2.0–7.2.12; 7.0.0–7.0.18","FortiManager: 7.6.0–7.6.5; 7.4.0–7.4.9; 7.2.0–7.2.11; 7.0.0–7.0.15","FortiAnalyzer: 7.6.0–7.6.5; 7.4.0–7.4.9; 7.2.0–7.2.11; 7.0.0–7.0.15","FortiProxy: 7.6.0–7.6.4; 7.4.0–7.4.12; 7.2.0–7.2.15; 7.0.0–7.0.22","FortiWeb: 8.0.0–8.0.3; 7.6.0–7.6.6; 7.4.0–7.4.11","FortiSwitchManager: 7.2.0–7.2.8; 7.0.0–7.0.7","FortiNAC-F: 7.6.3–7.6.5","Siemens RUGGEDCOM APE1808: all versions with Fortinet NGFW below 7.4.11"],"fixed":["FortiOS: 7.6.6, 7.4.11, 7.2.13, 7.0.19 or later in the respective branch","FortiManager: 7.6.6, 7.4.10, 7.2.12, 7.0.16 or later in the respective branch","FortiAnalyzer: 7.6.6, 7.4.10, 7.2.12, 7.0.16 or later in the respective branch","FortiProxy: 7.6.5, 7.4.13, 7.2.16, 7.0.23 or later in the respective branch","FortiWeb: 8.0.4, 7.6.7, 7.4.12 or later in the respective branch","FortiSwitchManager: 7.2.9, 7.0.8 or later in the respective branch","FortiNAC-F: 7.6.6 or later","Siemens RUGGEDCOM APE1808: Fortinet NGFW 7.4.11 or later; contact Siemens support"],"matches":[],"sources":[{"kind":"advisory","title":"Administrative FortiCloud SSO authentication bypass — FG-IR-26-060","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-060","by":"Fortinet","date":"2026-01-27"},{"kind":"post","title":"Analysis of Single Sign-On Abuse on FortiOS","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios","by":"Fortinet","date":"2026-01-22"},{"kind":"advisory","title":"Fortinet CVE record for CVE-2026-24858","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24858.json","by":"Fortinet","date":"2026-06-09"},{"kind":"advisory","title":"SSA-975644: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices","url":"https://cert-portal.siemens.com/productcert/html/ssa-975644.html","by":"Siemens","date":"2026-05-12"},{"kind":"news","title":"Fortinet blocks exploited FortiCloud SSO zero day until patch is ready","url":"https://www.bleepingcomputer.com/news/security/fortinet-blocks-exploited-forticloud-sso-zero-day-until-patch-is-ready/","by":"BleepingComputer","date":"2026-01-27"},{"kind":"news","title":"Fortinet Patches Exploited FortiCloud SSO Authentication Bypass","url":"https://www.securityweek.com/fortinet-patches-exploited-forticloud-sso-authentication-bypass/","by":"SecurityWeek","date":"2026-01-28"}],"started":"2026-01-21","closed":"2026-06-09","created":"2026-11-03T22:34:40.837Z","updated":"2026-11-03T22:34:40.837Z","cve_notes":[{"cve":"CVE-2026-24858","name":"FortiCloud SSO administrative login bypass","what":"An access-control flaw in Fortinet's FortiCloud single sign-on lets an attacker with their own account and registered device gain administrative access to another customer's affected device when that sign-on feature is enabled.","severity":"critical","cvss":9.4}],"timeline":[{"at":"2026-06-09","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Fortinet updated its CVE record, which lists fixes across the affected product lines, including FortiNAC-F 7.6.6, FortiWeb 8.0.4/7.6.7/7.4.12 and FortiSwitchManager 7.2.9/7.0.8.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/24xxx/CVE-2026-24858.json","by":"Fortinet","patch":"patched"},{"at":"2026-03-10","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"Siemens published guidance for RUGGEDCOM APE1808 devices running Fortinet NGFW below 7.4.11. It directed customers to obtain the 7.4.11 or later update through support.","url":"https://cert-portal.siemens.com/productcert/html/ssa-975644.html","by":"Siemens","patch":null},{"at":"2026-01-30","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Fortinet said it had updated the advisory with the last release updates.","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios","by":"Fortinet","patch":null},{"at":"2026-01-28","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"Fortinet corrected its initial scope warning: only FortiCloud SSO was affected. Third-party SAML identity providers and FortiAuthenticator were unaffected.","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios","by":"Fortinet","patch":null},{"at":"2026-01-27","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"Fortinet published CVE-2026-24858 and restored SSO while blocking vulnerable devices. Initial fixes covered FortiOS 7.4.11 and FortiManager/FortiAnalyzer 7.4.10; other releases were pending, and CISA added the flaw to its exploited-vulnerability catalogue.","url":"https://www.securityweek.com/fortinet-patches-exploited-forticloud-sso-authentication-bypass/","by":"SecurityWeek","patch":"partial"},{"at":"2026-01-26","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Fortinet disabled FortiCloud SSO on its service to prevent further abuse.","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios","by":"Fortinet","patch":null},{"at":"2026-01-22","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Fortinet acknowledged a new attack path affecting devices already updated against its December SSO vulnerabilities. It recommended disabling FortiCloud SSO while a fix was developed.","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios","by":"Fortinet","patch":null},{"at":"2026-01-21","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Customers reported compromised FortiGate firewalls running the latest available firmware. Attackers used FortiCloud single sign-on and created local administrator accounts.","url":"https://www.bleepingcomputer.com/news/security/fortinet-blocks-exploited-forticloud-sso-zero-day-until-patch-is-ready/","by":"BleepingComputer","patch":"none"}],"url":"https://hard.fyi/live/fortinet-forticloud-sso-bypass-jan-2026/","json":"https://hard.fyi/api/live?id=fortinet-forticloud-sso-bypass-jan-2026"}