CVE-2026-24858Fortinet follow-on SSO SAML bypass after the 59718 patch
What broke
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices that had already taken the December 2025 patches for CVE-2025-59718 and CVE-2025-59719 were still exploitable. CISA published guidance on 28 January 2026. Exploitation is in the wild.
Why it matters
This is the incomplete-fix pattern from ruby-saml, now on a firewall SSO plane that was already being exploited in December. "We patched FortiCloud SSO in December" is not a closed ticket. Attackers who burned 59718 simply moved to the leftover path.
What to do
- Apply the January 2026 Fortinet builds that name CVE-2026-24858. Confirm the build string, not the calendar date of your last change window.
- Leave FortiCloud SSO off unless you have a reason to turn it back on.
- Re-hunt admin creation and config changes from late January 2026, even on boxes you thought were clean after December.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2026-24858
- CISA guidance, 28 January 2026
Related identity CVEs
Related on Start with Identity
- CVEN-able N-central auth bypass, incomplete patch of CVE-2026-18556
N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August
- CVEruby-saml auth bypass, incomplete fix of CVE-2025-25292
The March 2025 ruby-saml patch did not close the parser differential. CVE-2025-54572 is the incomplete-fix follow-on: still a critical SSO impersonation if you
- CVEFortiWeb auth bypass and path traversal, admin creation
FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the Decemb
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.