Fortinet Releases Security Advisory for FortiCloud SSO Login Authentication Bypass
Successful exploitation could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Summary
Successful exploitation could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Affected platforms
The following platforms are known to be affected:
Threat details
Exploitation of CVE-2026-24858
The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-24858 to their Known Exploited Vulnerabilities (KEV) Catalog. The NHS England National CSOC assesses exploitation as highly likely.
Introduction
Fortinet has released a security advisory to address a critical vulnerability affecting FortiAnalyzer, FortiManager, FortiOS and FortiProxy.
Devices are only vulnerable if the FortiCloud SSO login feature is enabled on the device.
-
CVE-2026-24858 - an 'Authentication Bypass Using an Alternate Path' vulnerability - CVSSv3 score: 9.1.
Remediation advice
Affected organisations are encouraged to review the Fortinet PSIRT FG-IR-26-060 and apply the relevant updates as soon as possible.
Definitive source of threat updates
Last edited: 28 January 2026 1:36 pm