--- id: "CVE-2026-24858" kind: "vulnerability" aliases: ["CVE-2026-24858"] title: "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet\u2026" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Fortinet Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fortinet fortianalyzer", "fixed": [], "affected": ">= 7.0.0, <= 7.0.15", "ecosystem": "vendor"}, {"name": "fortinet fortianalyzer", "fixed": [], "affected": ">= 7.2.0, <= 7.2.11", "ecosystem": "vendor"}, {"name": "fortinet fortianalyzer", "fixed": ["7.4.10"], "affected": ">= 7.4.0, < 7.4.10", "ecosystem": "vendor"}, {"name": "fortinet fortianalyzer", "fixed": ["7.6.6"], "affected": ">= 7.6.0, < 7.6.6", "ecosystem": "vendor"}, {"name": "fortinet fortimanager", "fixed": [], "affected": ">= 7.0.0, <= 7.0.15", "ecosystem": "vendor"}, {"name": "fortinet fortimanager", "fixed": [], "affected": ">= 7.2.0, <= 7.2.11", "ecosystem": "vendor"}, {"name": "fortinet fortimanager", "fixed": ["7.4.10"], "affected": ">= 7.4.0, < 7.4.10", "ecosystem": "vendor"}, {"name": "fortinet fortimanager", "fixed": ["7.6.6"], "affected": ">= 7.6.0, < 7.6.6", "ecosystem": "vendor"}, {"name": "fortinet fortinac-f", "fixed": ["7.6.6"], "affected": ">= 7.6.3, < 7.6.6", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.0.0, <= 7.0.22", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.2.0, <= 7.2.15", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.4.0, <= 7.4.12", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.6.0, <= 7.6.4", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": [], "affected": ">= 7.4.0, <= 7.4.11", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": [], "affected": ">= 7.6.0, <= 7.6.6", "ecosystem": "vendor"}, {"name": "fortinet fortiweb", "fixed": [], "affected": ">= 8.0.0, <= 8.0.3", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 7.0.0, <= 7.0.18", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 7.2.0, <= 7.2.12", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.4.11"], "affected": ">= 7.4.0, < 7.4.11", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.6.6"], "affected": ">= 7.6.0, < 7.6.6", "ecosystem": "vendor"}, {"name": "siemens ruggedcom ape1808 firmware", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "fortianalyzer", "fortimanager", "fortinet", "fortios", "fortiproxy", "self-hosted", "vendor"] not_affected_if: ["forticloud-sso-disabled", "no-fortinet-devices"] published_at: "2026-01-27T00:00:00+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-23T23:44:51+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24858", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24858", "first_seen_at": "2026-10-23T23:44:51+00:00"}] --- # An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet… Fortinet FortiAnalyzer, FortiManager, FortiOS and FortiProxy have an authentication bypass in FortiCloud SSO that lets an attacker log into devices registered to other FortiCloud accounts. The attacker needs their own FortiCloud account with a registered device, and the flaw is actively exploited in the wild per CISA KEV. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Fortinet Multiple Products affected ? fixed ? - vendor:fortinet fortianalyzer affected >= 7.0.0, <= 7.0.15 fixed ? - vendor:fortinet fortianalyzer affected >= 7.2.0, <= 7.2.11 fixed ? - vendor:fortinet fortianalyzer affected >= 7.4.0, < 7.4.10 fixed 7.4.10 - vendor:fortinet fortianalyzer affected >= 7.6.0, < 7.6.6 fixed 7.6.6 - vendor:fortinet fortimanager affected >= 7.0.0, <= 7.0.15 fixed ? - vendor:fortinet fortimanager affected >= 7.2.0, <= 7.2.11 fixed ? - vendor:fortinet fortimanager affected >= 7.4.0, < 7.4.10 fixed 7.4.10 - vendor:fortinet fortimanager affected >= 7.6.0, < 7.6.6 fixed 7.6.6 - vendor:fortinet fortinac-f affected >= 7.6.3, < 7.6.6 fixed 7.6.6 - vendor:fortinet fortiproxy affected >= 7.0.0, <= 7.0.22 fixed ? - vendor:fortinet fortiproxy affected >= 7.2.0, <= 7.2.15 fixed ? - vendor:fortinet fortiproxy affected >= 7.4.0, <= 7.4.12 fixed ? - vendor:fortinet fortiproxy affected >= 7.6.0, <= 7.6.4 fixed ? - vendor:fortinet fortiweb affected >= 7.4.0, <= 7.4.11 fixed ? - vendor:fortinet fortiweb affected >= 7.6.0, <= 7.6.6 fixed ? - vendor:fortinet fortiweb affected >= 8.0.0, <= 8.0.3 fixed ? - vendor:fortinet fortios affected >= 7.0.0, <= 7.0.18 fixed ? - vendor:fortinet fortios affected >= 7.2.0, <= 7.2.12 fixed ? - vendor:fortinet fortios affected >= 7.4.0, < 7.4.11 fixed 7.4.11 - vendor:fortinet fortios affected >= 7.6.0, < 7.6.6 fixed 7.6.6 - vendor:siemens ruggedcom ape1808 firmware affected ? fixed ? ## How to check Check whether FortiCloud SSO authentication is enabled on FortiAnalyzer, FortiManager, FortiOS or FortiProxy devices. ## Fix Apply the mitigation from Fortinet's vendor advisory for CVE-2026-24858, or disable FortiCloud SSO authentication if mitigations are unavailable; sources do not name the fixed versions. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-24858 - 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-24858 ## From the sources An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_