CVE 2026 24858 in FortiOS the failure of SSO that is already being exploited and how to defend you

Fortinet has started publishing patches to correct critical vulnerability in FortiOS that is already being exploited in real environments. Identified as CVE-2026-24858 and with a high CVSS score (9.4), it is a bypass-type authentication failure related to FortiCloud's single login mechanism (SSO), which also affects FortiManager and FortiAnalyzer and could affect other research products.

In simple terms, vulnerability allows an attacker with a FortiCloud account and a registered device to use alternative access to log in on devices that belong to other accounts when the FortiCloud SSO function is activated. This vector has been used by malicious actors to obtain administrative control: they have created local administrator accounts, modified configurations to grant VPN access to those accounts and have removed firewall configurations to maintain presence and pivote on affected networks. Fortinet describes this abuse in more detail in his technical analysis posted on his PSIRT blog.

It is important to clarify that the FortiCloud SSO function is not activated in the factory configuration. It only comes into operation in scenarios where an administrator records the device in FortiCare from the graphical interface and explicitly activates the option of allowing administrative login through FortiCloud SSO. This reduces the potential scope, but does not eliminate the risk: if the functionality has been enabled in any installation, that installation can be susceptible.

In the face of the discovery of the exploitation, Fortinet took several measures in the cloud to mitigate the attack. Among the actions that the company has reported are the blocking of FortiCloud accounts used by the attackers and the temporary deactivation of FortiCloud SSO at cloud service level, followed by a partial reactivation with restrictions that prevent login from devices that have not been updated. Details and versions affected and corrected are found in FortiGuard's official security notice FG-IR-26-060.

The speed and severity of the problem have led to the US Infrastructure and Cybersecurity Agency. US (CISA) include this vulnerability in its catalogue of known exploited vulnerabilities ( KEV), forcing federal agencies to remedy it expeditiously. The official notice of CISA explaining the inclusion in the catalogue is available Here..

If you manage Fortinet devices, the recommendation is to address risk urgently. The essential minimum is to update the equipment to the firmware versions that correct the failure, but it is also necessary to audit the configurations and records in search of new administrative accounts or unauthorized changes: the presence of newly created local users, policy rules with unexpected modifications or VPN entries giving wide access are signs of commitment. Fortinet advises restoring from a known and clean configuration copy if anomalies are detected and changing relevant credentials, including those used against LDAP or Active Directory directories connected to FortiGate.

Beyond the patch, there are operational measures that help reduce immediate exposure, such as disable FortiCloud SSO if not strictly necessary, review which devices are registered in FortiCloud and check the traceability of accounts with administrative permits. Fortinet's guides and technical notes on how to identify commitment indicators and recommended steps are available in their official communications PSIRT and in the above-mentioned SSO abuse analysis.

To follow the consolidated technical information on vulnerability, you can see the entry into the CVE repository and the NIST base, where there are metric summary and public references: CVE-2026-24858 and NVD: CVE-2026-24858.

The lesson for managers and security officials is clear: the combination of remote management functions and SSO adds convenience, but it also increases the attack vector if it is not strictly controlled who and how devices are recorded in cloud services. The prudence and speed in applying updates and auditing configurations are the best defense in the case of holdings already occurring on the ground.

If you think any of your Fortinet devices could be compromised, treat the affected infrastructure as if it had already been violated, notify the response teams and, if appropriate, consult incident specialists to contain and clean the platform following official recommendations. Keep the communications of Fortinet and the safety agencies under surveillance to apply any additional indication or additional patch that appears.