{"id":"CVE-2026-24858","kind":"vulnerability","aliases":["CVE-2026-24858"],"related":[],"title":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet…","description":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.","summary":"Fortinet FortiAnalyzer, FortiManager, FortiOS and FortiProxy have an authentication bypass in FortiCloud SSO that lets an attacker log into devices registered to other FortiCloud accounts. The attacker needs their own FortiCloud account with a registered device, and the flaw is actively exploited in the wild per CISA KEV.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-01-27T00:00:00+00:00","products":[{"name":"Fortinet Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet fortianalyzer","fixed":[],"affected":">= 7.0.0, <= 7.0.15","ecosystem":"vendor"},{"name":"fortinet fortianalyzer","fixed":[],"affected":">= 7.2.0, <= 7.2.11","ecosystem":"vendor"},{"name":"fortinet fortianalyzer","fixed":["7.4.10"],"affected":">= 7.4.0, < 7.4.10","ecosystem":"vendor"},{"name":"fortinet fortianalyzer","fixed":["7.6.6"],"affected":">= 7.6.0, < 7.6.6","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":[],"affected":">= 7.0.0, <= 7.0.15","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":[],"affected":">= 7.2.0, <= 7.2.11","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":["7.4.10"],"affected":">= 7.4.0, < 7.4.10","ecosystem":"vendor"},{"name":"fortinet fortimanager","fixed":["7.6.6"],"affected":">= 7.6.0, < 7.6.6","ecosystem":"vendor"},{"name":"fortinet fortinac-f","fixed":["7.6.6"],"affected":">= 7.6.3, < 7.6.6","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 7.0.0, <= 7.0.22","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 7.2.0, <= 7.2.15","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 7.4.0, <= 7.4.12","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 7.6.0, <= 7.6.4","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":[],"affected":">= 7.4.0, <= 7.4.11","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":[],"affected":">= 7.6.0, <= 7.6.6","ecosystem":"vendor"},{"name":"fortinet fortiweb","fixed":[],"affected":">= 8.0.0, <= 8.0.3","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 7.0.0, <= 7.0.18","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 7.2.0, <= 7.2.12","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.4.11"],"affected":">= 7.4.0, < 7.4.11","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":["7.6.6"],"affected":">= 7.6.0, < 7.6.6","ecosystem":"vendor"},{"name":"siemens ruggedcom ape1808 firmware","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortianalyzer","fortimanager","fortinet","fortios","fortiproxy","self-hosted","vendor"],"not_affected_if":["forticloud-sso-disabled","no-fortinet-devices"],"how_to_check":"Check whether FortiCloud SSO authentication is enabled on FortiAnalyzer, FortiManager, FortiOS or FortiProxy devices.","fix":"Apply the mitigation from Fortinet's vendor advisory for CVE-2026-24858, or disable FortiCloud SSO authentication if mitigations are unavailable; sources do not name the fixed versions.","status":"open","published_at":"2026-01-27T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:29+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:42:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation from Fortinet's vendor advisory for CVE-2026-24858, or disable FortiCloud SSO authentication if mitigations are unavailable; sources do not name the fixed versions.\nunknown","reach":"internet","summary":"Fortinet FortiAnalyzer, FortiManager, FortiOS and FortiProxy have an authentication bypass in FortiCloud SSO that lets an attacker log into devices registered to other FortiCloud accounts. The attacker needs their own FortiCloud account with a registered device, and the flaw is actively exploited in the wild per CISA KEV.","category":"vendor","who_cares":["fortinet","fortios","fortimanager","fortianalyzer","fortiproxy","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker logs into other customers' Fortinet devices and takes administrative control.","analyst_note":"Find Fortinet's PSIRT advisory for CVE-2026-24858 to get affected and fixed versions, the mitigation steps, and the exact SSO setting to check.","how_to_check":"Check whether FortiCloud SSO authentication is enabled on FortiAnalyzer, FortiManager, FortiOS or FortiProxy devices.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["forticloud-sso-disabled","no-fortinet-devices"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000527,"input_tokens":2609,"output_tokens":532,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-24858':18A,21A '-288':12A,140C '7.0.0':157C,173C,195C,211C '7.0.15':159C,175C '7.0.18':197C '7.0.22':213C '7.2.0':153C,169C,191C,207C '7.2.11':155C,171C '7.2.12':193C '7.2.15':209C '7.4.0':149C,165C,187C,203C,223C '7.4.10':189C '7.4.11':225C '7.4.12':205C '7.4.9':151C,167C '7.6.0':145C,161C,183C,199C,219C '7.6.3':179C '7.6.4':201C '7.6.5':147C,163C,181C,185C '7.6.6':221C '8.0.0':215C '8.0.3':217C 'account':105B,112B,233C,246C 'activ':121B 'allow':227C 'altern':6A,134C 'ape1808':69A 'attack':97B,107B,229C 'authent':2A,89B,130C,250C 'bypass':3A,90B,131C 'channel':9A,137C 'cisa':127B 'cve':16A,19A 'cwe':11A,139C 'devic':100B,116B,237C,242C,255C 'enabl':252C 'exploit':71B,122B 'f':44A,178C 'firmware':70A 'flaw':119B 'fortianalyz':72B,82B,144C,148C,152C,156C 'fortianalyzer':26A,28A,30A,32A 'forticloud':92B,104B,111B,232C,248C 'fortimanag':73B,83B,160C,164C,168C,172C 'fortimanager':34A,36A,38A,40A 'fortinac':43A,177C 'fortinac-f':42A,176C 'fortinet':15A,22A,25A,27A,29A,31A,33A,35A,37A,39A,41A,45A,47A,49A,51A,53A,55A,57A,59A,61A,63A,65A,74B,81B,143C 'fortio':75B,84B,182C,186C,190C,194C 'fortios':60A,62A,64A,66A 'fortiproxi':76B,86B,198C,202C,206C,210C 'fortiproxy':46A,48A,50A,52A 'fortiweb':54A,56A,58A,214C,218C,222C 'host':79B 'kev':128B 'let':95B 'log':98B,239C 'may':226C 'multiple':23A 'need':108B 'path':7A,135C 'per':126B 'products':24A 'regist':101B,115B,236C,243C 'ruggedcom':68A 'self':78B 'self-host':77B 'siemens':67A 'sso':93B,249C 'use':4A,132C 'vendor':80B 'vulner':10A,13A,138C,141C 'wild':125B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-27T00:00:00+00:00","kev":{"dateAdded":"2026-01-27","dueDate":"2026-01-30","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-24858","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24858","severity":null,"published_at":"2026-01-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:40+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-24858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24858","severity":null,"published_at":"2026-01-27T20:16:24+00:00","modified_at":"2026-06-17T10:23:43+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}