Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected
Summary: Fortinet released updates for CVE-2026-24858, a CVSS 9.4 authentication bypass in FortiOS single sign-on that also affects FortiManager and FortiAnalyzer, after confirming active exploitation in the wild. Fortinet said the flaw may let an attacker with a FortiCloud account and a registered device log into other devices registered to other accounts when FortiCloud SSO is enabled, and CISA added it to the KEV catalog with a January 30, 2026 remediation deadline for FCEB agencies.
Why it matters: Attackers used this SSO path to create local admin accounts, grant those accounts VPN access, and exfiltrate firewall configurations - so any internet-facing Fortinet device with FortiCloud SSO enabled should be treated as breached until checked, not just patched.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-24858
- Related
- CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Jan 27, 2026