Article
Two Fortinet events of 2026: what to check
Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from…
Read more
Significant cyber incident
Fortinet FortiCloud SSO exploitation
In January 2026, attackers abused a new login bypass (CVE-2026-24858) in Fortinet's FortiCloud single sign-on.
In short
In January 2026, attackers abused a new login bypass (CVE-2026-24858) in Fortinet's FortiCloud single sign-on. Someone with a FortiCloud account and a registered device could log in to other customers' devices if FortiCloud SSO was enabled. Fortinet saw firewall changes, new admin accounts and VPN changes, even on devices already patched against the December 2025 SSO bugs. CISA added it to its exploited-vulnerabilities list on 27 January 2026, so any exposed Fortinet admin login needed review.
What happened
On 22 January 2026 Fortinet published a blog warning of unexpected logins on FortiGate devices that looked like its December 2025 SSO bugs. It then found the same activity on devices that were fully patched, which pointed to a new flaw.
Fortinet says two malicious FortiCloud accounts used the flaw and were locked out on 22 January. It turned FortiCloud SSO off on 26 January and back on 27 January, no longer accepting logins from vulnerable versions. The advisory (FG-IR-26-060) and CVE-2026-24858 were published on 27 January.
CISA added the CVE to its Known Exploited Vulnerabilities Catalog on 27 January and published guidance on 28 January. Public sources name no victims. A later campaign against Fortinet devices used leaked credentials rather than this flaw, see Fortinet device credential exposure. The Canadian Cyber Centre’s alert on that campaign advises a patch check for CVE-2025-59718 and CVE-2025-59719, the December 2025 SSO flaws discussed above.
Timeline
-
December 2025
Fortinet issues an advisory for two earlier FortiCloud SSO bypass bugs, CVE-2025-59718 and CVE-2025-59719
-
2026-01-22
Fortinet locks out two malicious FortiCloud accounts, and publishes a blog warning of SSO abuse on FortiOS
-
2026-01-23
Fortinet disables FortiCloud accounts that were being abused (blog update log)
-
2026-01-26
Fortinet disables FortiCloud SSO on the FortiCloud side
-
2026-01-27
FortiCloud SSO is re-enabled and no longer accepts logins from vulnerable versions
-
2026-01-27
Fortinet publishes advisory FG-IR-26-060; NVD publishes CVE-2026-24858
-
2026-01-27
CISA adds CVE-2026-24858 to the KEV Catalog; Canada's Cyber Centre publishes AV26-059
-
2026-01-28
CISA publishes its alert; Fortinet confirms third-party SAML identity providers and FortiAuthenticator are not impacted
-
2026-01-30
KEV due date for federal agencies; Fortinet adds the last release updates to the advisory
How the attack worked
The flaw
FortiCloud SSO lets an administrator sign in to a device with a FortiCloud account. The flaw is an authentication bypass using an alternate path or channel (CWE-288). A person with a FortiCloud account and a registered device could log in to devices registered to other accounts, if FortiCloud SSO login was on.
The feature is off by default. Registering a device to FortiCare from its web interface turns it on unless the administrator switches off the toggle. Fortinet says the bug affects FortiCloud SSO only, not third-party identity providers.
What the actor did
Fortinet saw the actor sign in with SSO, then create a local admin account for persistence in almost all cases. It describes the main goals as downloading the device configuration and adding an admin account. CISA reports firewall changes, new accounts and VPN changes that gave access to new accounts. Fortinet says the actor later moved to Cloudflare-protected IP addresses.
Why patching was not enough at first
The December 2025 bugs used a crafted SAML message. This one did not need that, and it worked on devices already on the fixed release. Fortinet fixed it on its cloud side first, by refusing SSO logins from vulnerable versions.
No source gives MITRE ATT&CK ids for this incident, so none are listed.
Who says who was behind it
No public attribution. Fortinet refers to "the actor" and to two malicious FortiCloud accounts. CISA and Canada's Cyber Centre name no actor.
Impact
CISA reports unauthorized firewall configuration changes on FortiGate devices, unauthorized account creation and VPN changes granting access to new accounts. Fortinet describes the attack as a "small number" of customer reports at first, and says local admin creation was seen in almost all cases. No source gives a count of victims or names an organization. KEV lists known ransomware use as "Unknown".
Government and regulator response
- 22 January 2026: Fortinet locks out two malicious FortiCloud accounts and publishes its analysis and indicators.
- 26 to 27 January 2026: Fortinet turns FortiCloud SSO off, then back on without support for vulnerable versions. It publishes FG-IR-26-060 on 27 January.
- 27 January 2026: CISA adds CVE-2026-24858 to KEV with a due date of 30 January; Canada’s Cyber Centre publishes AV26-059.
- 28 January 2026: CISA urges users to check for indicators of compromise on internet-accessible products and apply updates.
- Fortinet advice: upgrade, optionally switch off FortiCloud SSO login, limit admin access, and if indicators are found treat the configuration as compromised and rotate credentials.
Lessons
-
A patched device can still be exposed
Devices on the latest release for the December 2025 bugs were still hit, so one fix does not close a whole feature.
-
Convenience features widen the attack surface
SSO login is off by default but turns on when a device is registered unless the toggle is cleared, so many owners may not know it is on.
-
Cloud-side controls can protect faster than patches
Fortinet cut off vulnerable versions on its cloud side within days, but customers still had to upgrade to use SSO again.
-
Attackers plant a second way in
A local admin account was created in almost all cases, so removing the SSO path alone would not evict them.
-
Admin interfaces should not face the internet
Fortinet repeats that unrestricted internet administration of edge devices is not best practice.
What to check in your own organization
-
Find FortiCloud SSO
List every FortiOS, FortiManager, FortiAnalyzer, FortiProxy and FortiWeb device and check whether "Allow administrative login using FortiCloud SSO" is on.
-
Check versions
Compare each version with the fixed releases in Fortinet advisory FG-IR-26-060, for example FortiOS 7.6.6 or above.
-
Review admin accounts
Look for unexpected local admins. Fortinet lists names such as audit, backup, itadmin, secadmin and support.
-
Review logins and config
Search logs for SSO admin logins you do not recognize, and review firewall and VPN changes since December 2025.
-
Limit admin access
Restrict management interfaces to trusted addresses or out-of-band access, as Fortinet advises.
-
If indicators are found
Treat the device and its config as compromised, restore a clean config and rotate credentials, including connected LDAP/AD accounts.
-
Early warning
Threat intelligence monitoring can watch new vulnerability alerts and exploited-vulnerability lists for the products you run, and exposed admin credentials. Here the first public warning came on 22 January and the KEV listing on 27 January, so an alert could have started a check of exposed devices within days. This is a possibility, not a promise.
Questions
What is CVE-2026-24858?
An authentication bypass in Fortinet's FortiCloud SSO. A person with a FortiCloud account and a registered device could log in to devices registered to other accounts.
Which products are affected?
CISA lists FortiOS, FortiManager, FortiWeb, FortiProxy and FortiAnalyzer. Fortinet's advisory also lists FortiSwitchManager and FortiNAC-F.
Was it exploited?
Yes. Fortinet reports exploitation by two malicious FortiCloud accounts, and CISA added it to the KEV Catalog on 27 January 2026.
Am I safe if I patched the December 2025 bugs?
Not necessarily. CISA says users were vulnerable even if they had updated for CVE-2025-59718 and CVE-2025-59719.
Are third-party SSO setups affected?
Fortinet confirmed that third-party SAML identity providers and FortiAuthenticator are not impacted.
Who was behind it?
No public attribution.
In our research
Sources
- Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858 CISA
- Administrative FortiCloud SSO authentication bypass (FG-IR-26-060) Fortinet PSIRT
- Analysis of Single Sign-On Abuse on FortiOS Fortinet PSIRT blog
- CVE-2026-24858 record NIST National Vulnerability Database
- Known Exploited Vulnerabilities Catalog (JSON feed) CISA
- Fortinet security advisory (AV26-059) Canadian Centre for Cyber Security
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.