CVE-2026-24858Fortinet administrative FortiCloud SSO authentication bypass across accounts
What broke
CVE-2026-24858 is an authentication bypass using an alternate path or channel (CWE-288, CVSS 3.1 9.8) in the administrative FortiCloud SSO login of FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, FortiWeb and FortiNAC-F. Fortinet advisory FG-IR-26-060 says an attacker who holds a FortiCloud account and a registered device could log in to other devices registered to other accounts, as long as FortiCloud SSO login was enabled on them. That setting is off by default but is switched on when an administrator registers the device from the GUI and does not turn the toggle off.
Fortinet says two malicious FortiCloud accounts exploited it in the wild, and locked them out on January 22, 2026. Its January 22 incident post reported exploitation of a device that "had been fully upgraded" at the time, so devices patched for the December 2025 FortiCloud SSO flaws CVE-2025-59718 and CVE-2025-59719 were still exposed. Fortinet describes this as a new attack path, not a flaw in SAML generally: a January 28 update said it affects FortiCloud SSO only, not third-party SAML identity providers or FortiAuthenticator. Fortinet published the advisory and CISA added the CVE to KEV on January 27, 2026.
Update, October 31, 2026: corrected the disclosure date to January 27, 2026 and the weakness to CWE-288, and reworded this brief to follow FG-IR-26-060. An earlier version described the flaw as a SAML signature bypass, which the advisory does not say.
Why it matters
A vendor cloud account became an admin credential for other customers' firewalls. The device trusted "signed in through FortiCloud" without checking that the FortiCloud account belonged to the device's owner. After logging in, the actor downloaded configuration files and created local admin accounts with names such as audit, backup and support for persistence. "We patched FortiCloud SSO in December" was not a closed ticket: attackers moved from the December flaws to this path within weeks.
What to do
- Upgrade to the fixed release for your product line in FG-IR-26-060 (for example FortiOS 7.6.6, 7.4.11, 7.2.13 or 7.0.19). Confirm the build string, not the date of your last change window.
- Turn off "Allow administrative login using FortiCloud SSO" (
set admin-forticloud-sso-login disable) unless you need it. A custom IdP in its place is not affected. - Review every admin account for unexpected entries, and re-hunt configuration downloads and admin creation from January 2026.
After you patch
- Delete unknown local admins, then revoke all sessions on the appliance.
- Rotate the directory or LDAP service account, VPN certificates and any stored integration credentials, because configuration files were taken.
- Check downstream: anything the appliance could reach or authenticate to is in scope.
Sources
Related identity CVEs
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- FortiCloud SSO bypass hits FortiGates already patched for CVE-2025-59718 2026 · Identity infrastructure vulnerability
Related on Start with Identity
- CVEFortiWeb auth bypass and path traversal, admin creation
FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the Decemb
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- GlossarySSO Enforcement
SSO enforcement is an application setting that makes single sign-on through the organization's identity provider the only way to sign in, disabling or removing
- GlossarySSO Identifier (SSO ID)
An SSO identifier, or SSO ID, is the value an identity provider sends to an application to say which user just signed in: the `NameID` in a [SAML](/glossary/sam
- GlossarySSO Tax
The SSO tax is the practice of offering single sign-on (SAML or OIDC) only on a higher-priced plan, an enterprise plan or a paid add-on, so that a customer must