CVE-2026-24858

9.8

CRITICAL CVSS 3.1

Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability - [Actively Exploited]

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

INFO

Published Date :

Jan. 27, 2026, 8:16 p.m.

Last Modified :

Jan. 29, 2026, 1:16 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Jan 30, 2026

Alert Date: Jan 27, 2026 | 25 days ago

Description :

Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-060 ; https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios ; https://nvd.nist.gov/vuln/detail/CVE-2026-24858

Affected Products

The following products are affected by CVE-2026-24858 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Fortinet	fortimanager
2	Fortinet	fortios
3	Fortinet	fortiproxy
4	Fortinet	fortiweb
5	Fortinet	fortianalyzer
6	Fortinet	fortianalyzer

: Total Affected Vendor : 1 | Products : 6

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				6abe59d8-c742-4dff-8ce8-9b0ca1073da8
	CVSS 3.1	CRITICAL				[email protected]

Solution

Update Fortinet products to a fixed version to prevent unauthorized access via FortiCloud SSO.

Update FortiAnalyzer to version 7.6.6 or later.
Update FortiManager to version 7.6.6 or later.
Update FortiOS to version 7.6.6 or later.

Public PoC/Exploit Available at Github

CVE-2026-24858 has a 12 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-24858.

URL	Resource
https://fortiguard.fortinet.com/psirt/FG-IR-26-060	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858	US Government Resource
https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios	Mitigation Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-24858 is associated with the following CWEs:

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-24858 weaknesses.

CAPEC-127: Directory Indexing Directory Indexing CAPEC-665: Exploitation of Thunderbolt Protection Flaws Exploitation of Thunderbolt Protection Flaws

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

kpong1941/Security-Runbook

Security Runbooks

Updated: 4 days, 15 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 16, 2026, 11:25 a.m. This repo has been linked 1 different CVEs too.

gagaltotal/cve-2026-24858

CVE-2026-24858 - Administrative FortiCloud SSO authentication bypass

exploit fortigate fortigate-firewall fortnite python python3 scanner

Python

Updated: 1 week, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 10, 2026, 5:51 p.m. This repo has been linked 1 different CVEs too.

lucacapacci/PoC-in-GitHub

Mirror of https://github.com/nomi-sec/PoC-in-GitHub

Updated: 1 week, 5 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 7, 2026, 10:02 a.m. This repo has been linked 789 different CVEs too.

aryan2737/Week_9

None

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 31, 2026, 11:19 a.m. This repo has been linked 3 different CVEs too.

SimoesCTT/SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity

While Fortinet's January 27, 2026 mitigation for **CVE-2026-24858** focuses on blocking specific accounts like `[email protected]`, it fails to address the **Temporal Vulnerability** of the SAML state machine.

Python

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 31, 2026, 9:41 a.m. This repo has been linked 1 different CVEs too.

SimoesCTT/The-SCTT-Master-Registry

None

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 31, 2026, 7:15 a.m. This repo has been linked 3 different CVEs too.

SimoesCTT/SCTT-2026-33-0003-FortiCloud-Identity-Field-Singularity

While Fortinet scrambled to disable and then re-enable their SSO service this week, they only patched the "Alternate Path" logic. They haven't accounted for a Sovereign Vector that uses the \alpha frequency to synchronize malicious sessions across account boundaries.

Python

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Jan. 31, 2026, 7:06 a.m. This repo has been linked 1 different CVEs too.

SimoesCTT/-CTT-NSP-Convergent-Time-Theory---Network-Stack-Projection-CVE-2026-24858-

A Proof-of-Concept demonstrating the application of 3D Navier-Stokes CTT formulations to packet flow optimization and defensive bypass.

Python

Updated: 3 weeks ago

0 stars 0 fork 0 watcher

Born at : Jan. 30, 2026, 4:27 a.m. This repo has been linked 1 different CVEs too.

absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 FortiCloud Single Sign On (SSO) a factory default enabled feature once you register any FortiGate/FortiManager/FortiAnalyzer contains a critical authentication bypass flaw.

Updated: 2 weeks, 3 days ago

1 stars 1 fork 1 watcher

Born at : Jan. 30, 2026, 3:29 a.m. This repo has been linked 1 different CVEs too.

b1gchoi/CVE-2026-24858

CVE-2026-24858: Authentication Bypass in Fortinet Products via FortiCloud SSO

Python

Updated: 2 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Jan. 29, 2026, 4:36 p.m. This repo has been linked 1 different CVEs too.

m0d0ri205/CVE-2026-24858

아직 제로데이인거 같아, 공개되거나 천천히 분석할 예정....

Updated: 3 weeks, 1 day ago

0 stars 0 fork 0 watcher

Born at : Jan. 28, 2026, 2:34 p.m. This repo has been linked 1 different CVEs too.

wkaandemir/Guvenlik-Rehberi

None

Updated: 2 weeks, 4 days ago

21 stars 3 fork 3 watcher

Born at : Dec. 10, 2025, 4:24 p.m. This repo has been linked 20 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-24858 vulnerability anywhere in the article.

Daily CyberSecurity

JPCERT/CC Warns of Active Exploits Targeting Critical FileZen Command Injection Flaw

A critical security vulnerability in FileZen, the popular file transfer appliance from Soliton Systems K.K., is currently under active attack. In a new security advisory, JPCERT/CC has sounded the ala ...

Published Date: Feb 16, 2026 (5 days, 3 hours ago)

Daily CyberSecurity

Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network Takeover

Image: win3zz A critical vulnerability in widely used remote access software is currently under active attack, with threat actors using the flaw to plant backdoors and scout corporate networks. Arctic ...

Published Date: Feb 15, 2026 (5 days, 23 hours ago)

Daily CyberSecurity

Critical Alert: Chrome Zero-Day (CVE-2026-2441) Exploited in the Wild

Google has pushed an urgent security update for its Chrome browser, racing to patch a high-severity zero-day vulnerability that is currently being exploited by attackers in the wild. The flaw, tracked ...

Published Date: Feb 15, 2026 (6 days, 1 hour ago)

Daily CyberSecurity

Inside Job: Abandoned Outlook Add-in “AgreeTo” Steals 4,000 Credentials

The phishing page | Image: Koi Security In a disturbing first for enterprise security, researchers at Koi Security have uncovered a malicious Microsoft Outlook add-in actively harvesting credentials i ...

Published Date: Feb 13, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Triple Threat Patched: Zimbra 10.1.16 Fixes XSS, XXE & LDAP Injection

Zimbra has rolled out a significant security update for its collaboration suite, releasing Zimbra 10.1.16 to address a spectrum of vulnerabilities ranging from front-end script injection to back-end d ...

Published Date: Feb 13, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Email Under Siege: Storm-2603 Exploits SmarterMail to Deploy Warlock Ransomware

A new report from ReliaQuest has uncovered a dangerous alliance between a China-based threat actor and a known ransomware strain. The group, identified as Storm-2603, has been caught actively exploiti ...

Published Date: Feb 13, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Back to the Future: SSHStalker Botnet Revives 2009 Tactics to Hijack Linux Servers

Image: Flare A previously undocumented Linux botnet has been discovered prowling the internet, using a mix of ancient tactics and modern automation to compromise servers. Dubbed SSHStalker by research ...

Published Date: Feb 13, 2026 (1 week, 1 day ago)

Daily CyberSecurity

CVE-2026-1603: Remote Unauthenticated Attacker Can Steal Ivanti EPM Secrets

Ivanti has rolled out important security updates for its Endpoint Manager (EPM), addressing a pair of vulnerabilities that could expose sensitive credentials to hackers. The release fixes one high-sev ...

Published Date: Feb 12, 2026 (1 week, 1 day ago)

Daily CyberSecurity

Crash Loop: Palo Alto Networks Flaw (CVE-2026-0229) Forces Maintenance Mode

Palo Alto Networks has issued a security advisory for a denial-of-service (DoS) vulnerability affecting its PAN-OS software, specifically within the Advanced DNS Security (ADNS) feature. The flaw, tra ...