FortiCloud SSO: exploited vulnerability bypasses authentication
CVE-2026-24858 bypasses authentication in FortiOS, FortiManager and FortiAnalyzer when FortiCloud SSO is enabled; compromised firewalls were seen from 21 January.
What happened
Vulnerability CVE-2026-24858 has a CVSS score of 9.4 and affects FortiOS, FortiManager and FortiAnalyzer. It is only exploitable with FortiCloud SSO enabled, an option that turns on when the device is registered with FortiCare unless it is disabled. From 21 January compromised firewalls were seen, with administrator accounts created and configurations downloaded. Fortinet disabled SSO on 26 January and restored it on 27 January, blocking vulnerable firmware.
Why it matters
The flaw is not in a password but in a trust mechanism that is switched on almost by accident when a device is registered. A compromised firewall is the worst place to lose control: from there all traffic is seen and decided, and the administrator accounts the attacker created do not show up in a list nobody reviews. That Fortinet had to disable the service remotely shows the scale of the urgency, and the firmware keeps working as if nothing had happened.
What we recommend
Update the devices, audit administrator accounts and access and disable FortiCloud SSO if it is not used. Administrator accounts nobody created are the first thing to look for, along with exported configurations or configuration backups that were not made from within the organisation. This is checked on the device itself, not in the vendor portal.
Related service: ciberseguridad · infraestructura-cloud
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.