Fortinet CVE-2026-24858: Active Exploitation, SSO Bypass, CVSS…

Fortinet has patched CVE-2026-24858, a critical authentication bypass with a CVSS 9.8 score that is under active exploitation. CISA has mandated remediation by January 30, 2026, for federal agencies.

On January 27, 2026, the Cybersecurity and Infrastructure Security Agency added CVE-2026-24858 to its Known Exploited Vulnerabilities catalog with a remediation deadline of January 30, 2026. The vulnerability, rated CVSS 9.8 CRITICAL by the National Vulnerability Database, allows authentication bypass on Fortinet devices through an architectural flaw in the trust relationship between the appliance and the FortiCloud SSO service. Active exploitation has already led to device takeovers, creation of local administrative accounts, and exfiltration of firewall configurations.

Key Takeaways

CVE-2026-24858 is an authentication bypass with a CVSS 9.8 score that exploits the FortiCloud SSO trust logic to gain access to devices registered to other accounts.
Threat actors created local admin accounts, modified VPN configurations, and exfiltrated data; Fortinet identified and blocked two malicious accounts on January 22, 2026.
Fortinet temporarily disabled FortiCloud SSO globally on January 26, 2026, re-enabling it the next day with restrictions on vulnerable versions.
CISA added the vulnerability to the KEV catalog on January 27, 2026, with two remediation deadlines of January 30, 2026, later extending guidance to FortiWeb and FortiProxy products.

The Bypass Mechanism: When Cross-Tenant Trust Fails

The National Vulnerability Database describes CVE-2026-24858 as an Authentication Bypass Using an Alternate Path or Channel, with CWE identifier CWE-288. The flaw resides in the implementation of trust between Fortinet devices and the FortiCloud SSO service: the authentication logic fails to validate that the requesting device belongs to the same account as the originally registered device.

According to the NVD record, an attacker with a FortiCloud account and a registered device can log in to other devices registered to different accounts, provided FortiCloud SSO authentication is enabled on those target devices. The necessary condition is explicit: the 'Allow administrative login using FortiCloud SSO' toggle must be active. Fortinet notes this functionality is not enabled by default and requires FortiCare registration.

The issue is architectural: in a federated multi-tenant system, the failure to validate account context in the token flow allows any cloud-registered device to impersonate administrative identity on devices belonging to different tenants. It is a classic authorization bypass where the convenience of unified access translates into a permeable security boundary.

Confirmed Exploitation: Malicious Accounts and Documented Post-Exploitation

The Hacker News reported details of the active exploitation citing direct communications from Fortinet. Unidentified threat actors abused this "new attack path" to obtain unauthenticated SSO login, creating local administrative accounts for persistence, modifying configurations to grant VPN access, and exfiltrating firewall configurations.

Fortinet blocked two specific accounts on January 22, 2026: cloud-noc@mail.io and cloud-init@mail.io. The identity of the operators remains undetermined; no publicly documented infrastructure overlaps link this activity to known threat groups. The dossier does not specify whether the exploit was available as a public proof-of-concept or distributed through illicit markets.

The described tactics — persistence via local accounts, escalation through VPN modification, configuration exfiltration — indicate an objective of prolonged access to victim internal networks rather than simple vandalism. The ability to modify VPN policies suggests attackers intended to establish encrypted tunnels for lateral movement following initial compromise of the edge device.

Fortinet's Response: Global Service Disabling as the Only Mitigation

The severity of the situation is evident in the countermeasures adopted by Fortinet. The company disabled FortiCloud SSO server-side on January 26, 2026 — an unprecedented measure that impacted all customers with the service active, regardless of their known exposure. SSO was re-enabled on January 27, 2026, with a specific block for devices running vulnerable versions.

This sequence reveals two critical elements. First: the flaw was not mitigable through server-side countermeasures without suspending the service entirely, indicating the vulnerability resides in the core authorization logic rather than peripheral configurations. Second: the compressed timeline between exploitation detection (January 22), global disabling (January 26), and re-enabling with restrictions (January 27) suggests extreme operational pressure and a perceived risk of uncontrolled expansion.

On January 28, 2026, CISA issued additional guidance extending the list of affected products to FortiWeb and FortiProxy, beyond the already known FortiOS, FortiManager, and FortiAnalyzer. Fortinet also ruled out impact on third-party SAML IdPs or FortiAuthenticator, delimiting the flaw's perimeter to the FortiCloud SSO ecosystem alone.

Immediate Actions

For organizations with Fortinet infrastructure, priority actions derive from the official guidance available in the dossier:

Verify Exposure. Check if FortiCloud SSO is enabled on devices; the attack condition explicitly requires the 'Allow administrative login using FortiCloud SSO' toggle. If the service is active, exposure is immediate regardless of other network configurations.

Apply Updates Released by Fortinet. The NVD record lists affected versions for each product family, from FortiOS to FortiProxy, but does not specify the release numbers that remediate the vulnerability. It is necessary to consult vendor advisories directly to identify patched builds.

Check for Anomalous Local Administrative Accounts. Documented exploitation involves creation of admin accounts for persistence; verification must extend to recent modifications of VPN policies, which represent the most specific indicator of the reported post-exploitation activity.

Meet the KEV Deadline for Covered Entities. CISA has set mandatory remediation for January 30, 2026, for Federal Civilian Executive Branch agencies under Binding Operational Directive 22-01. Private organizations operating with government contracts or in critical supply chains should also treat this date as an operational reference.

Cloud SSO as an Attack Surface: Beyond Fortinet

The CVE-2026-24858 incident raises an architectural question that transcends a single vendor. Centralizing administrative authentication through federated cloud services introduces a unified attack surface that can target geographically and organizationally distributed instances. When trust between device and cloud service lacks rigorous tenancy constraints, the boundary between accounts becomes theoretical.

Fortinet's decision to temporarily disable a paid service for all customers — with the operational impact that entails — indicates that the reputational and legal risk of uncontrolled expansion was judged superior to the cost of service discontinuity. For CISOs, this is a signal on the fragility of contractual guarantees when the vulnerability lies in the vendor's authorization logic.

The dossier does not specify the number of compromised organizations nor the current status of the investigation into FortiSwitch Manager, still under evaluation at the time of publication.

Sources

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references