Start with Identity
Identity CVE · SAML

CVE-2026-24858Fortinet follow-on SSO SAML bypass after the 59718 patch

criticalCISA KEVActively exploited
Product: Fortinet products (FortiCloud SSO)Vendor: FortinetCWE-347Disclosed: 2026-01-28Status: Actively exploitedProtocol deep diveNVD ↗CISA KEV ↗

What broke

CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices that had already taken the December 2025 patches for CVE-2025-59718 and CVE-2025-59719 were still exploitable. CISA published guidance on 28 January 2026. Exploitation is in the wild.

Why it matters

This is the incomplete-fix pattern from ruby-saml, now on a firewall SSO plane that was already being exploited in December. "We patched FortiCloud SSO in December" is not a closed ticket. Attackers who burned 59718 simply moved to the leftover path.

What to do

  • Apply the January 2026 Fortinet builds that name CVE-2026-24858. Confirm the build string, not the calendar date of your last change window.
  • Leave FortiCloud SSO off unless you have a reason to turn it back on.
  • Re-hunt admin creation and config changes from late January 2026, even on boxes you thought were clean after December.

After you patch

Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.

  • Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
  • Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
  • Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
  • Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.

Sources

Last reviewed By SWI Community TeamSuggest a correctionHow we research

Technique

This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.

Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.