CVE-2026-24858

What it actually does

This is a network-reachable authentication bypass in Fortinet products that support FortiCloud single sign-on. When FortiCloud SSO is enabled, the affected products may incorrectly trust an alternate authentication path or channel, allowing a user who has a FortiCloud account and a registered device to authenticate to devices registered under other FortiCloud accounts. Successful exploitation can give the attacker authenticated access to the target administrative interface or management plane, with potential confidentiality, integrity, and availability impact depending on the product role and the privileges assigned through the SSO flow. Affected product families include FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy, FortiWeb, and listed Siemens Ruggedcom APE1808 firmware/platforms that incorporate affected Fortinet components.

Why it matters to the business

Compromise of these products can be highly disruptive because they often sit in security-critical positions: firewalls, proxies, web application firewalls, network access control, and centralized security management/logging. An attacker who gains unauthorized administrative access may be able to change security policy, create persistence, disable protections, access logs or configuration data, pivot into managed devices, or disrupt network connectivity. The issue is listed in CISA KEV, has reported active exploitation in the wild, and had a federal remediation due date of 2026-01-30, which is now past; organizations should treat remaining exposure as urgent. The broad product coverage increases operational risk because the same authentication weakness may exist across perimeter, management, and monitoring appliances.

How an attack unfolds

An attacker first obtains or uses a valid FortiCloud account and a device registered to that account. The attacker then targets an affected Fortinet product where FortiCloud SSO is enabled. Because the vulnerable implementation does not correctly bind the FortiCloud SSO authentication context to the device owner or expected tenant/account relationship, the attacker can complete an authentication flow that is accepted by a device registered to a different account. If successful, the attacker gains access as an authenticated user on the target device and can proceed to enumerate configuration, alter settings, create or modify administrative access, collect sensitive data, disable controls, or use the compromised product as a foothold into managed networks. Public reporting identifies this as actively exploited, so defenders should assume exposed and SSO-enabled instances may have been targeted.

How to fix it

Upgrade affected products to Fortinet or vendor-provided fixed releases as soon as available from the official advisory and support channels. Because no exact fixed versions were provided in the input, verify remediation against the current Fortinet PSIRT advisory and Siemens Ruggedcom guidance for the specific product branch in use. Until patched, disable FortiCloud SSO on affected devices where operationally feasible, restrict administrative access to trusted management networks or VPN-only access, block internet exposure of administrative interfaces, enforce local or federated authentication paths not affected by this issue, and review all FortiCloud account/device associations. For FortiManager and FortiAnalyzer, also review managed-device permissions and administrative roles because compromise of those systems can affect many downstream devices. After upgrade or mitigation, rotate administrative credentials and API keys where unauthorized access is suspected, remove unknown accounts or tokens, and validate that configuration backups have not been tampered with.

How to confirm the fix worked

Inventory all Fortinet and Siemens Ruggedcom assets in scope and compare installed versions against the affected ranges: FortiAnalyzer 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiManager 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiNAC-F 7.6.3-7.6.5; FortiOS 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.12, 7.0.0-7.0.18; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.12, 7.2.0-7.2.15, 7.0.0-7.0.22; FortiWeb 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11. Confirm whether FortiCloud SSO is enabled on each device. A system is remediated only when it is upgraded to a vendor-confirmed fixed version or when FortiCloud SSO is disabled and management access is otherwise restricted as a compensating control. Validate by checking device firmware/build versions, confirming FortiCloud SSO configuration state, reviewing administrative account lists, and testing that only expected accounts can authenticate through approved channels.

Typical attack path

1. Identify internet-facing or reachable Fortinet administrative interfaces or management services that support FortiCloud SSO.
2. Determine whether FortiCloud SSO is enabled on the target device.
3. Use a FortiCloud account with a registered device to initiate the alternate SSO authentication path.
4. Abuse the authentication-binding flaw so the target device accepts authentication for an account/device relationship that should not be authorized.
5. Access the target product as an authenticated user.
6. Review or export configuration, logs, device inventory, security policy, VPN/proxy/WAF settings, or managed-device information.
7. Make unauthorized changes such as adding accounts, modifying policies, weakening controls, or creating persistence.
8. Use the compromised appliance or manager to pivot, disrupt services, or conceal follow-on activity.

How to detect it

Look for evidence of successful FortiCloud SSO authentication by unexpected FortiCloud users, unknown account IDs, unfamiliar registered devices, unusual source IP addresses, or logins outside normal administrative patterns. Useful sources include Fortinet system event logs, administrator audit logs, FortiCloud SSO/authentication logs, FortiManager and FortiAnalyzer administrative logs, FortiWeb/FortiProxy/FortiOS event logs, VPN or management-plane access logs, SIEM-ingested Fortinet telemetry, reverse proxy logs in front of management interfaces, and configuration change history. Hunt for successful SSO logins followed by high-risk actions such as new administrator creation, role changes, API token generation, configuration export, firmware changes, policy package installation, disabling logging, changing log forwarding, modifying firewall/proxy/WAF policies, adding trusted hosts, or deleting audit records. Correlate FortiCloud SSO events with FortiCloud account/device ownership where available; authentication from an account or registered device not associated with the appliance owner is especially suspicious. Because active exploitation is reported, review from at least the publication date and preferably earlier if FortiCloud SSO was enabled before disclosure. Also inspect configuration backups and change-control records for unapproved differences after any suspicious login.

What your security team should do

• Immediately identify all affected Fortinet and Siemens Ruggedcom assets, prioritizing internet-facing administrative interfaces, FortiManager, FortiAnalyzer, FortiOS firewalls, FortiProxy, FortiWeb, and FortiNAC-F deployments.
• Treat this as urgent because it is in CISA KEV, has active exploitation in the wild, has a high EPSS score, and the KEV due date has passed.
• Disable FortiCloud SSO on affected systems until patched if the feature is not strictly required.
• Upgrade to vendor-confirmed fixed versions from Fortinet or Siemens guidance; verify exact target releases for each product branch before change windows.
• Restrict management interfaces to trusted administrative networks, VPN-only access, or bastion hosts; remove direct internet exposure wherever possible.
• Review all FortiCloud SSO login events, administrative logins, account changes, policy changes, and configuration exports since at least the publication date, and extend the lookback where logs are available.
• Audit administrative users, API tokens, automation accounts, FortiCloud account associations, and registered devices; remove unknown or stale entries.
• For FortiManager, review managed device changes and policy package revisions for unauthorized modifications that may have propagated to downstream devices.
• For FortiAnalyzer, verify log integrity and investigate gaps, deletion events, unexpected forwarding changes, or altered retention settings.
• If suspicious access is found, rotate credentials, revoke sessions/tokens, preserve logs and configuration backups, and perform incident response across connected or managed devices.