Confirmed Zero-day Vulnerability in Fortinet Products (CVE-2026-24858)

THE THREAT

On January 27th, 2026, Fortinet released a security advisory disclosing a zero-day vulnerability impacting multiple Fortinet products. The flaw, tracked as CVE-2026-24858 (CVSS: 9.8), is a critical authentication bypass vulnerability in FortiOS, FortiManager, FortiAnalyzer, and FortiProxy. It allows an attacker with a FortiCloud account and a registered device to authenticate into devices registered to other accounts via an alternate authentication path or channel. The vulnerability can only be exploited on devices with FortiCloud Single Sign-On (SSO) enabled.

Security patches for the affected product versions are under development at the time of writing. Fortinet stated that the SSO login feature will not allow login from devices running vulnerable versions. Organizations are advised to update vulnerable instances to secure versions as soon as patches become available.

What we're doing about it

• eSentire Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices
• eSentire MDR for Network has detections to identify exploitation of CVE-2026-24858
• eSentire MDR for Log includes detections designed to identify behaviors associated with the exploitation of Fortinet devices
• The Threat Response Unit (TRU) has conducted threat hunts across eSentire customers
• The eSentire Threat Intelligence team is tracking CVE-2026-24858 for additional detection opportunities

What you should do about it

• Apply the relevant security updates as soon as they are available
• Disable FortiCloud SSO login feature on Fortinet devices
  • On FortiOS and FortiProxy:
    • Go to System → Settings → Switch "Allow administrative login using FortiCloud SSO" to Off

    • Or use the CLI command:

      config system global 
      set admin-forticloud-sso-login disable
      end

  • On FortiManager and FortiAnalyzer:
    • Go to System Settings → SAML SSO → Switch "Allow admins to login with FortiCloud" to Off

    • Or use the CLI command:

      config system saml
      set forticloud-sso disable
      end

Additional information

On January 22nd, Fortinet investigated reports from customers about malicious SSO login activity that involved two attacker-controlled FortiCloud accounts being used to access victim devices. Security researchers also observed similar activity involving the creation of generic accounts to maintain persistence, changes to grant VPN access, and exfiltration of firewall configuration data. This activity was initially believed to be linked to a patch bypass of another authentication bypass vulnerability, CVE-2025-59718, which had been disclosed, patched, and reported as exploited in the wild in December 2025. Due to the similarities in the exploitation patterns, the recent activity was attributed to the previously patched flaw.

Recent disclosure confirms that the two flaws differ, with CVE-2026-24858 being an authentication bypass by an alternate path or channel, and CVE-2025-59718 occurring due to improper verification of a cryptographic signature.

Following the disclosure, CISA added CVE-2026-24858 to its Known Exploited Vulnerabilities (KEV) catalog, providing federal agencies only three days to mitigate the flaw. On January 26th, Fortinet globally disabled FortiCloud SSO logins from the server side to prevent further exploitation, and re-enabled it on January 27th, ensuring logins from vulnerable instances are blocked. Fortinet also noted that the issue affects all SAML SSO implementations. While logins from vulnerable devices are currently restricted, organizations can still disable FortiCloud SSO on the client side as an additional precaution. FortiWeb and FortiSwitch Manager are still under investigation to determine the impact of the flaw.

Fortinet vulnerabilities are often targeted by threat actors, as they provide easy access to an organization's network. Recent activity included the creation of secondary administrator accounts and exfiltration of configuration data, indicating attempts to establish persistence and map the victim network. This suggests potential efforts for long-term access to compromise networks in the future. Organizations are therefore advised to check for signs of compromise, and Fortinet recommends contacting them if any associated Indicators of Compromise (IoCs) are observed. 

References: 
[1] https://www.fortiguard.com/psirt/FG-IR-26-060 
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-24858 
[3] https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios 
[4] https://nvd.nist.gov/vuln/detail/CVE-2025-59718 
[5] https://www.cisa.gov/news-events/alerts/2026/01/27/cisa-adds-one-known-exploited-vulnerability-catalog