CISA Adds FortiCloud SSO Authentication Bypass to Known Exploited Vulnerabilities List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a serious Fortinet flaw to its Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-24858.

The vulnerability affects multiple Fortinet products that rely on FortiCloud Single Sign-On (SSO) and is classified as an authentication bypass using an alternate path or channel (CWE-288).

According to CISA, federal civilian agencies are required to apply vendor mitigations or discontinue use of affected products by January 30, 2026.

While CISA has not confirmed active use in ransomware campaigns, the KEV entry means the flaw is already being exploited in the wild or poses an immediate, real-world threat.

Vulnerability Details

CVE-2026-24858 impacts Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy when FortiCloud SSO authentication is enabled.

Due to an authentication bypass issue, an attacker with a valid FortiCloud account and at least one registered device could potentially log in to other Fortinet devices registered under different FortiCloud accounts.

In practice, this breaks the trust boundary between FortiCloud tenants. Instead of being limited to systems owned by their own account, an attacker may be able to pivot into other organisations’ devices that use FortiCloud SSO.

This could allow unauthorised access to administrative interfaces, policy management, logging, and network traffic controls, depending on the specific product and deployment.

If exploited, the vulnerability could enable attackers to:

• Gain administrative access to Fortinet appliances belonging to other organizations
• Modify security policies and rules
• Interfere with logging and monitoring
• Potentially weaken or disable critical security controls

Because these products are often deployed at the core of enterprise and government networks, successful exploitation can have wide operational and security impact.

CISA urges organizations to follow Fortinet’s official advisories and apply all security updates or configuration fixes related to CVE-2026-24858 as soon as possible.

If mitigations are not available or cannot be applied in time, CISA recommends disabling FortiCloud SSO on affected devices or discontinuing use of the impacted products.

Organizations outside the U.S. federal space are strongly advised to treat this vulnerability with the same urgency and prioritize patching and hardening efforts.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.