CVE-2026-24858: Fortinet FortiCloud SSO Cross-Device Authentication Bypass (KEV, Exploited)

CVE-2026-24858 lets an attacker who controls any FortiCloud account use FortiCloud single sign-on to log into other customers' FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb and FortiNAC-F devices; Fortinet found it exploited in the wild, disabled FortiCloud SSO network-wide to contain it, and CISA added it to KEV the same week, though the 9.8 CVSS figure is Fortinet's own CNA score rather than an NVD Primary rating.

CVE-2026-24858 is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) in Fortinet's FortiCloud single sign-on feature. Fortinet's PSIRT advisory FG-IR-26-060 states that "malicious actors with a FortiCloud account and a registered device [can] log in to separate devices registered to other users" across FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiSwitch Manager and FortiNAC-F when FortiCloud SSO is enabled on the target device (Fortinet PSIRT FG-IR-26-060).

Fortinet states the vulnerability "was found being exploited in the wild by two malicious FortiCloud accounts, which were locked out on 2026-01-22," and that it temporarily disabled all FortiCloud SSO authentication on 2026-01-26 before reinstating it on 2026-01-27 with changes intended to block the exploitation path. This followed two related, previously disclosed FortiCloud SSO bypass issues (CVE-2025-59718 and CVE-2025-59719); Fortinet notes patching those earlier bugs alone does not remediate CVE-2026-24858 (Fortinet PSIRT FG-IR-26-060).

CISA added CVE-2026-24858 to the Known Exploited Vulnerabilities catalog on 2026-01-27, with a required-action due date of 2026-01-30, listing the affected vendor/project as Fortinet across FortiAnalyzer, FortiManager, FortiOS and FortiProxy; known ransomware campaign use is recorded as "Unknown" (CISA KEV).

NVD's record for this CVE shows status "Analyzed," but the only CVSS entry on file is a CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) submitted by Fortinet's own PSIRT ([email protected]) and marked Secondary — NVD has not published an independent Primary CVSS metric for this CVE as of this check. This page therefore attributes the 9.8 score to Fortinet PSIRT rather than labeling it NVD-confirmed, while still indexing the page because KEV presence alone is independently sufficient grounds under our publishing rules (NVD).

Fortinet's recommended remediation is to apply the patched build appropriate to each affected product (via the upgrade path listed at docs.fortinet.com) or, as an immediate mitigation, disable FortiCloud SSO login for the device under System Settings or via the CLI. FIRST EPSS currently scores the probability of exploitation at 0.8659 (99.7th percentile) as of 2026-10-30, consistent with a cross-tenant authentication bypass with confirmed in-the-wild abuse (FIRST EPSS).

• FortiCloud SSO authentication bypass lets an attacker with any FortiCloud account and registered device log into other users' devices across FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiSwitch Manager and FortiNAC-F when FortiCloud SSO is enabled. — Fortinet PSIRT FG-IR-26-060
• Found exploited in the wild via two malicious FortiCloud accounts locked out on 2026-01-22; Fortinet briefly disabled all FortiCloud SSO authentication (2026-01-26 to 2026-01-27) to contain it; patching the earlier CVE-2025-59718/CVE-2025-59719 bypasses does not remediate this issue. — Fortinet PSIRT FG-IR-26-060
• Added to the CISA KEV catalog on 2026-01-27, due date 2026-01-30, known ransomware use Unknown. — CISA KEV
• NVD vulnStatus is Analyzed, but the only CVSS metric present (3.1, 9.8) is sourced from [email protected] and marked type Secondary; no NVD Primary CVSS metric exists for this CVE. — NVD
• EPSS score is 0.8659 (99.7th percentile) as of 2026-10-30. — FIRST EPSS