NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Fortinet FortiCloud SSO login bypass CVE-2026-24858 exploited; fixes available

Attackers used FortiCloud single sign-on to take over other customers’ Fortinet devices and steal configurations. Fixes now cover all affected branches. Ask your IT provider to update and investigate earlier access; patching alone does not clean up a compromise.

What to do

If your home office, family office or business uses Fortinet equipment, ask its IT provider to install the applicable fixed release below or a later supported version. Have them check for unexpected administrators and configuration changes; if compromised, restore or audit the configuration and rotate exposed credentials, including connected directory accounts.

What’s happening

CVE-2026-24858 let someone with their own FortiCloud account and registered device gain administrative access to another customer's vulnerable device when FortiCloud single sign-on was enabled. It affects FortiGate firewalls running FortiOS and several Fortinet management, proxy and security products. Attackers stole device configurations and created administrator accounts to retain access, including on firewalls updated against earlier SSO flaws. Fortinet temporarily stopped cloud SSO, then restored it with vulnerable firmware blocked. Its current advisory names fixes for every affected branch; Siemens also provides an update path for affected RUGGEDCOM installations. Custom identity providers are unaffected. Previously compromised devices still require investigation, configuration recovery and credential changes. The sources reviewed do not establish a final victim count or that all intrusions have been cleaned up. Fortinet displays a severity score of 9.4; Siemens lists 9.8.

What
Flaw
Affects
Fortinet FortiGate/FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiSwitchManager and FortiNAC-F
Affected
The following Fortinet versions are affected when FortiCloud SSO authentication is enabled.
FortiOS: 7.6.0–7.6.5; 7.4.0–7.4.10; 7.2.0–7.2.12; 7.0.0–7.0.18
FortiManager: 7.6.0–7.6.5; 7.4.0–7.4.9; 7.2.0–7.2.11; 7.0.0–7.0.15
FortiAnalyzer: 7.6.0–7.6.5; 7.4.0–7.4.9; 7.2.0–7.2.11; 7.0.0–7.0.15
FortiProxy: 7.6.0–7.6.4; 7.4.0–7.4.12; 7.2.0–7.2.15; 7.0.0–7.0.22
FortiWeb: 8.0.0–8.0.3; 7.6.0–7.6.6; 7.4.0–7.4.11
FortiSwitchManager: 7.2.0–7.2.8; 7.0.0–7.0.7
FortiNAC-F: 7.6.3–7.6.5
Siemens RUGGEDCOM APE1808: all versions with Fortinet NGFW below 7.4.11
Fixed in
FortiOS: 7.6.6, 7.4.11, 7.2.13, 7.0.19 or later in the respective branch
FortiManager: 7.6.6, 7.4.10, 7.2.12, 7.0.16 or later in the respective branch
FortiAnalyzer: 7.6.6, 7.4.10, 7.2.12, 7.0.16 or later in the respective branch
FortiProxy: 7.6.5, 7.4.13, 7.2.16, 7.0.23 or later in the respective branch
FortiWeb: 8.0.4, 7.6.7, 7.4.12 or later in the respective branch
FortiSwitchManager: 7.2.9, 7.0.8 or later in the respective branch
FortiNAC-F: 7.6.6 or later
Siemens RUGGEDCOM APE1808: Fortinet NGFW 7.4.11 or later; contact Siemens support
CVE
CVE-2026-24858
Since
21 Jan 2026
Closed
9 June 2026

Timeline

  1. Vendor revisedFixed

    Fortinet updated its CVE record, which lists fixes across the affected product lines, including FortiNAC-F 7.6.6, FortiWeb 8.0.4/7.6.7/7.4.12 and FortiSwitchManager 7.2.9/7.0.8.

  2. New fix

    Siemens published guidance for RUGGEDCOM APE1808 devices running Fortinet NGFW below 7.4.11. It directed customers to obtain the 7.4.11 or later update through support.

  3. Vendor revised

    Fortinet said it had updated the advisory with the last release updates.

  4. Vendor revised

    Fortinet corrected its initial scope warning: only FortiCloud SSO was affected. Third-party SAML identity providers and FortiAuthenticator were unaffected.

  5. CISA addedPartly fixed

    Fortinet published CVE-2026-24858 and restored SSO while blocking vulnerable devices. Initial fixes covered FortiOS 7.4.11 and FortiManager/FortiAnalyzer 7.4.10; other releases were pending, and CISA added the flaw to its exploited-vulnerability catalogue.

  6. Update

    Fortinet disabled FortiCloud SSO on its service to prevent further abuse.

  7. Made public

    Fortinet acknowledged a new attack path affecting devices already updated against its December SSO vulnerabilities. It recommended disabling FortiCloud SSO while a fix was developed.

  8. Made publicNo fix yet

    Customers reported compromised FortiGate firewalls running the latest available firmware. Attackers used FortiCloud single sign-on and created local administrator accounts.

Sources

  1. Administrative FortiCloud SSO authentication bypass — FG-IR-26-060Fortinet · 27 Jan 2026
  2. Analysis of Single Sign-On Abuse on FortiOSFortinet · 22 Jan 2026
  3. Fortinet CVE record for CVE-2026-24858Fortinet · 9 June 2026
  4. SSA-975644: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 DevicesSiemens · 12 May 2026
  5. Fortinet blocks exploited FortiCloud SSO zero day until patch is readyBleepingComputer · 27 Jan 2026
  6. Fortinet Patches Exploited FortiCloud SSO Authentication BypassSecurityWeek · 28 Jan 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from January 2026 · JSON · RSS