forticloud sso bypass reached fully patched fortigates
A second FortiCloud single sign-on flaw let attackers holding a FortiCloud account and a registered device log into other customers' Fortinet devices, even ones patched for December's SSO bug.
- cve
- CVE-2026-24858 (preceded by CVE-2025-59718 / CVE-2025-59719)
- cvss
- 9.8 (v3.1, Fortinet) for all three
- affected
- FortiOS 7.6.0–7.6.5, 7.4.0–7.4.10, 7.2.0–7.2.12, 7.0.0–7.0.18; also FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiSwitchManager, FortiNAC-F
- fixed in
- FortiOS 7.6.6 / 7.4.11 / 7.2.13 / 7.0.19 (other products per FG-IR-26-060)
- exploited
- yes — CVE-2026-24858 added to CISA KEV 2026-01-27; CVE-2025-59718 added 2025-12-16
- platforms
- Fortinet appliances with FortiCloud SSO admin login enabled
what happened
- On 2025-12-09 Fortinet disclosed CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), which let an unauthenticated attacker bypass FortiCloud SSO login with a crafted SAML message on FortiOS, FortiProxy, FortiSwitchManager and FortiWeb; CISA added CVE-2025-59718 to KEV on 2025-12-16.[2,5,6]
- On 2026-01-27 Fortinet published CVE-2026-24858 (CVSS 9.8, v3.1): an attacker with a FortiCloud account and a registered device could log into devices registered to other accounts if FortiCloud SSO was enabled on them.[1,4]
- CISA said devices were vulnerable to CVE-2026-24858 even if they had been updated for CVE-2025-59718 and CVE-2025-59719.[3]
- FortiCloud SSO login is off in factory defaults, but it is switched on when an administrator registers a device to FortiCare from the GUI unless the "Allow administrative login using FortiCloud SSO" toggle is turned off.[1,2]
- Fortinet locked out two malicious FortiCloud accounts on 2026-01-22, disabled FortiCloud SSO on 2026-01-26 and re-enabled it on 2026-01-27 with logins refused from devices running vulnerable versions.[1]
- Observed activity included unauthorized FortiGate configuration changes, new accounts and VPN changes granting access to them; Fortinet says attackers downloaded configuration files and created local admins with names such as "audit", "backup", "itadmin" and "support".[3,1]
- FortiOS fixes for CVE-2026-24858 are 7.6.6, 7.4.11, 7.2.13 and 7.0.19; CISA added it to KEV on 2026-01-27 with a 2026-01-30 due date.[1,6]
where sources differFortinet's FG-IR-26-060 lists FortiSwitchManager 7.0/7.2 as affected; NVD's CVE-2026-24858 description omits FortiSwitchManager, and CISA's alert names only FortiOS, FortiManager, FortiWeb, FortiProxy and FortiAnalyzer.
sources6
- 01FG-IR-26-060: Administrative FortiCloud SSO authentication bypass ↗ primaryFortinet PSIRTaccessed 2026-10-21
- 02FG-IR-25-647: Multiple Fortinet Products' FortiCloud SSO Login Authentication Bypass ↗ primaryFortinet PSIRTaccessed 2026-10-21
- 03Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858 ↗ primaryCISAaccessed 2026-10-21
- 04NVD CVE API record for CVE-2026-24858 ↗ primaryNIST NVDaccessed 2026-10-21
- 05NVD CVE API record for CVE-2025-59718 ↗ primaryNIST NVDaccessed 2026-10-21
- 06CISA Catalog of Known Exploited Vulnerabilities (JSON feed, catalogVersion 2026.10.21) ↗ primaryCISAaccessed 2026-10-21