CVE-2026-24858

The flaw lies in improper user identity verification during the authentication process through an alternative path or channel (FortiCloud SSO). An attacker, having their own legitimate FortiCloud account and at least one registered device, can bypass standard access controls and authenticate to devices belonging to other organizations or accounts, provided those devices have FortiCloud SSO enabled. The SSO mechanism improperly isolates sessions and identities between different tenants, creating a pathway for unauthorized access.

An attacker can gain full unauthorized access to Fortinet devices of other organizations — potentially taking control of network configuration, firewalls, management and analysis systems. The consequences include breach of confidentiality, integrity, and availability of protected systems (CVSS C:H/I:H/A:H).

Immediately apply patches available from the vendor according to references (https://fortiguard.fortinet.com/psirt/FG-IR-26-060). Until updates are installed, it is recommended to disable FortiCloud SSO functionality on all affected devices. Due to active exploitation (CISA KEV), remediation actions should be taken immediately.

FortiAnalyzer 7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5; FortiManager 7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5; FortiNAC-F 7.6.3–7.6.5; FortiOS 7.0.0–7.0.18, 7.2.0–7.2.12, 7.4.0–7.4.10, 7.6.0–7.6.5; FortiProxy 7.0.0–7.0.22, 7.2.0–7.2.15, 7.4.0–7.4.12, 7.6.0–7.6.4; FortiWeb 7.4.0–7.4.11, 7.6.0–7.6.6, 8.0.0–8.0.3. A necessary condition is that FortiCloud SSO functionality is enabled.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.