Fortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidance 28 January 2026.
CVE-2026-24858 is the leftover FortiCloud SSO SAML path after December 2025's CVE-2025-59718 / 59719. Arctic Wolf saw malicious FortiCloud logins three days after the first disclosure. CISA put 59718 on KEV with a one-week patch-by date. In January, CISA came back: devices that had taken that patch were still exploitable. Exploitation is in the wild.
This is the incomplete-fix pattern we already documented on ruby-saml and N-central, now on a firewall management plane. "We patched FortiCloud SSO in December" is not a closed ticket. The SAML protocol page is the place to put this for a network-and-identity joint review.
Why it matters
A SAML bypass on the appliance that filters the rest of the network is administrative control of the edge. Attackers who burned 59718 moved to 24858. If FortiCloud SSO is still enabled, disable it unless you have a reason, then confirm the January 2026 build string, not the month you last opened a change window.
Read the CVE-2026-24858 brief and re-hunt admin creation from late January 2026.
Source: NVD: CVE-2026-24858
Related on Start with Identity
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
- BlogGitLab patches a SAML-to-LDAP account takeover and OIDC discovery cache poisoning
GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-li
- BlogNetScaler patches a CVSS 9.5 memory overflow reachable only through SAML
CVE-2026-107406 can lead to remote code execution on NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Fixed in 1
- CVEGitHub Enterprise Server SAML bypass via libxml2 canonicalization
GitHub Enterprise Server accepted a crafted SAML response because libxml2 canonicalization quirks let the signed XML and the consumed XML diverge. High-severity
- CVEGitHub Enterprise Server SAML encrypted-assertion bypass
GHES with optional encrypted SAML assertions accepted a forged response. An unauthenticated attacker could provision a site administrator. Fixed in 3.9.15, 3.10
- CVEIvanti Connect Secure SAML SSRF, chained to auth bypass
SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CIS