After Fortinet’s two 2026 events, a firewall owner should check three things: which sign-in features are switched on, whether VPN and admin passwords have been reset, and whether any admin account is unknown. In January, a FortiCloud SSO login flaw reached devices that were already updated. In June, reused and weak logins were the route, according to Fortinet.
What happened in January, and why did updating not settle it?
CISA says CVE-2026-24858 let someone with a FortiCloud account and a registered device log in to devices registered to other users. It lists FortiOS, FortiManager, FortiWeb, FortiProxy and FortiAnalyzer as affected when FortiCloud SSO is enabled. CISA also says devices updated against the earlier December 2025 SSO bugs were still vulnerable, and Fortinet reports cases on fully upgraded devices.
Earlier FortiOS flaws have their own pages: CVE-2022-42475, CVE-2024-21762 and CVE-2024-55591.
The detail that matters for owners sits in Fortinet’s advisory. FortiCloud SSO login is off in default factory settings, but registering a device to FortiCare from the GUI turns it on unless the toggle is switched off. A patched version number therefore did not answer the real question, which is whether the login path was open at all. Our FortiCloud SSO incident page holds the full record.
- 22 Jan 2026Two malicious FortiCloud accounts locked outFortinet’s advisory says they were exploiting the flaw.
- 26 Jan 2026Fortinet disables FortiCloud SSO on its sideCISA says this was done to mitigate the flaw.
- 27 Jan 2026SSO re-enabled with changesFortinet says it no longer accepts logins from vulnerable versions. CISA adds the CVE to its KEV Catalog.
- 28 Jan 2026CISA alert releasedIt urges checks for indicators of compromise.
- 15 Jun 2026A researcher reports a campaignCERT-EU says it targeted exposed FortiGate SSL VPNs.
- 18 Jun 2026NCSC UK and Canada’s Cyber Centre issue alertsNCSC says FortiGate and VPN portals were targeted.
- 19 Jun 2026Fortinet publishes its analysisFortinet says this is not a new vulnerability.
What happened in June, and was it a new flaw?
CISA says malicious actors targeted internet-accessible Fortinet devices in government and private sector organizations using compromised credentials, and calls the activity FortiBleed. It ties leaked credentials to approximately 74,000 Fortinet devices, including firewalls and VPN gateways. NCSC UK says a threat actor leaked a database of credentials after brute-force, dictionary and credential stuffing attempts against FortiGate and VPN portals. There is no public attribution.
Fortinet says it is not a new vulnerability. It describes reuse of credentials from previous incidents and brute-force against devices with weak passwords and no MFA, and its post lists the January advisory among those earlier incidents. Our Fortinet credential exposure page has the details. CERT Vanuatu adds that valid credentials make login attempts look legitimate, so a logging check has to look for what the account then did.
What should a firewall owner check?
Both events point to the same short list. It starts with inventory: NCSC advises listing every Fortinet device and confirming each one is yours. After that, work through these checks, using the vendor and agency advice as written.
- Is FortiCloud SSO login on, and do we use it?Fortinet says it is off by default but turns on at GUI registration unless the toggle is switched off.
- Is administration reachable from the internet?CISA urges keeping it off the public internet. Fortinet lists trusted hosts, a local-in policy, or no internet administration.
- Have sessions ended and passwords been reset?CISA urges ending all active SSL VPN and admin sessions and resetting all Fortinet VPN and admin passwords.
- Which admin accounts exist?Fortinet saw a local admin created for persistence in almost all January cases and lists forticloud, fortiuser and fortinet-support in June.
- Is MFA enforced?CISA urges phishing-resistant MFA on all remote access and admin accounts. NCSC advises enabling PBKDF2 for admin accounts.
- What do the logs show?CISA urges reviewing firewall, VPN, authentication and domain controller logs for unusual access and configuration changes.
Disabling what you do not use also covers accounts. CISA urges removing unneeded accounts, and the Canadian Cyber Centre advises looking for accounts such as forticloud-sync and forticloud-tech.
Is resetting passwords enough?
Not always. NCSC advises isolating a compromised device from the internet and the internal network, and says changing credentials alone may not be enough if the actor has persistence. Its advice is a factory reset, after saving logs and configs because the reset destroys them. Fortinet’s January guidance is to treat the system and configuration as compromised if indicators are found and to rotate credentials, including connected LDAP/AD accounts. NCSC also advises checking other edge devices that share credentials with the affected one. For another network device case from 2026, see our page on the Cisco SD-WAN incident.
Could threat intelligence monitoring have given early warning?
It could have helped, though nothing here is a promise. Monitoring can watch vendor alerts and exploited-vulnerability lists for the products you run, and can show whether admin or VPN logins for your firewalls appear in leaked data.
In January, Fortinet’s analysis was first published on 22 January and CISA listed the CVE on 27 January, so an alert could have started a check of exposed devices within days. In June, a researcher reported the campaign on 15 June, and the government alerts followed on 18 June. A useful question for your team: who would have seen the first of those, and how fast could every admin and VPN login be reset? NCSC also points UK organizations to its free Early Warning service.
Related reading: NetScaler exposed edge: questions to ask your team.
Last checked against sources on 9 October 2026.