{"id":"CVE-2026-24858","published":"2026-01-27T20:16:24Z","modified":"2026-06-17T10:23:43Z","title":"Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability","vendor":"Fortinet","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an authentication bypass using an alternate path or channel (CWE-288) in multiple Fortinet products, including FortiOS, FortiAnalyzer, FortiManager, FortiProxy, FortiWeb and FortiNAC-F across the affected version ranges. An attacker holding a FortiCloud account and a registered device can log into other devices registered to other accounts, provided FortiCloud SSO authentication is enabled on those targets.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:53Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.86592,"percentile":0.99739,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-01-27","dueDate":"2026-01-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-060 ; https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios ; https://nvd.nist.gov/vuln/detail/CVE-2026-24858","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-01-27","exploitedFirstSeen":"2026-01-27","ransomware":false,"evidence":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-060","date":"2026-01-27"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-01-27"},{"url":"https://www.recordedfuture.com/blog/january-2026-cve-landscape","date":"2026-02-24"},{"url":"https://www.sentinelone.com/blog/fortigate-edge-intrusions/","date":"2026-03-10"},{"url":"https://fortgale.com/blog/defence/operation-storming-tide/","date":"2026-03-13"},{"url":"https://www.trendmicro.com/vinfo/gb/security/news/cybercrime-and-digital-threats/edge-under-siege-how-state-sponsored-actors-exploit-your-perimeter","date":"2026-04-20"},{"url":"https://www.techgines.com/post/fortibleed-fortigate-credential-compromise-86000-firewalls","date":"2026-06-21"},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2026/07/08/fortibleed-fortigate-credential-reuse-internet-exposed","date":"2026-07-08"},{"url":"https://www.wiz.io/blog/agentless-threat-hunting-fortigate","date":"2026-07-22"},{"url":"https://www.levelblue.com/blogs/spiderlabs-blog/ttp-briefing-q2-2026","date":"2026-07-23"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-060","tags":["Vendor Advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-975644.html","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858","tags":["US Government Resource"]},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios","tags":["Mitigation","Vendor Advisory"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exploited via public-facing FortiCloud SSO authentication bypass","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"may allow an attacker with a FortiCloud account and a registered device to log into other devices","start":762,"end":859}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Gains valid access to other accounts' devices","mappingType":"primary_impact","evidence":[{"from":"description","quote":"may allow an attacker with a FortiCloud account and a registered device to log into other devices","start":762,"end":859}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-4712","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4712","exploited":true,"exploitedSince":"2026-01-27","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":0,"earliest":"2026-01-28","earliestUrl":"https://github.com/m0d0ri205/CVE-2026-24858","repos":[{"name":"absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass","url":"https://github.com/absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass","stars":9,"created":"2026-01-30"},{"name":"gagaltotal/cve-2026-24858","url":"https://github.com/gagaltotal/cve-2026-24858","stars":1,"created":"2026-02-10"},{"name":"m0d0ri205/CVE-2026-24858","url":"https://github.com/m0d0ri205/CVE-2026-24858","stars":0,"created":"2026-01-28"},{"name":"SimoesCTT/-CTT-NSP-Convergent-Time-Theory---Network-Stack-Projection-CVE-2026-24858-","url":"https://github.com/SimoesCTT/-CTT-NSP-Convergent-Time-Theory---Network-Stack-Projection-CVE-2026-24858-","stars":0,"created":"2026-01-30"},{"name":"SimoesCTT/SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity","url":"https://github.com/SimoesCTT/SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity","stars":0,"created":"2026-01-31"}]},"first":{"date":"2026-01-28","source":"PoC-in-GitHub","url":"https://github.com/m0d0ri205/CVE-2026-24858"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2026-01-27","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24858","provenance":"source"},{"date":"2026-01-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-060","provenance":"source"},{"date":"2026-01-27","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-01-27","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4712","provenance":"source"},{"date":"2026-01-28","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/m0d0ri205/CVE-2026-24858","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":74.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 277 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9974"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}