CVE-2026-24858: Fortinet FortiCloud SSO authentication bypass across registered devices

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network, unauthenticated access, KEV listing with a three-day federal deadline and EPSS above the 99th percentile make this an immediate remediation priority.

What it is

A CWE-288 authentication bypass in Fortinet FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy and FortiWeb lets an attacker with a FortiCloud account and a registered device log into other devices registered to different accounts when FortiCloud SSO is enabled. The flaw spans many product lines and versions, and CISA added it to KEV with a three-day remediation deadline, so exposure is broad and urgent.

Impact

An attacker gains authenticated access to Fortinet devices belonging to other FortiCloud accounts, with the CVSS vector indicating high confidentiality, integrity and availability impact. That access can expose management planes and configuration data of security infrastructure.

Attack surface

Reachable over the network with no privileges or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The precondition is that the target device has FortiCloud SSO authentication enabled and the attacker holds a FortiCloud account with a registered device.

Exploitation

Listed in CISA KEV as of 2026-01-27 with a 2026-01-30 due date, and EPSS 30-day probability is 0.86088 (99.7th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented.

What to do

• Apply the Fortinet vendor patches for all affected product lines and versions listed in FG-IR-26-060.
• If patching cannot be completed immediately, disable FortiCloud SSO authentication on affected devices per Fortinet guidance.
• Follow CISA BOD 22-01 guidance for cloud services and meet the 2026-01-30 KEV remediation deadline.
• Audit FortiCloud account and device registrations, and remove or restrict SSO trust where it is not operationally required.
• For Siemens Ruggedcom APE1808 deployments, apply the guidance in Siemens advisory SSA-975644.

Detection

• Review authentication logs on FortiAnalyzer, FortiManager, FortiOS, FortiProxy and FortiWeb for successful SSO logins where the FortiCloud account does not match the device's registered owner.
• Alert on logins to management interfaces from unexpected source IPs or accounts shortly after FortiCloud SSO authentication events.
• Monitor for new or modified administrative accounts, configuration changes and policy edits on affected devices.
• Correlate FortiCloud SSO authentication events across devices to spot one account authenticating to multiple unrelated devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.