Loading story…
Fortinet disclosed CVE-2026-24858, a critical authentication bypass (CVSS 9.8, CWE-288: Alternate Authentication Path) affecting Fortinet products that support FortiCloud SSO. When FortiCloud SSO is enabled, an attacker with a FortiCloud account and a registered device can potentially authenticate to other organizations’ devices registered to different FortiCloud accounts, effectively bypassing expected administrative authentication controls.
Fortinet reported in-the-wild exploitation prior to patch availability, attributing activity to two attacker-controlled FortiCloud accounts that were subsequently blocked. Impacted versions include FortiAnalyzer (7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5), FortiManager (7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5), and FortiOS (7.0.0–7.0.18, 7.2.0–7.2.12, 7.4.0–7.4.10, 7.6.0–7.6.5), with fixed releases available in the corresponding patched branches. Recommended actions include urgent patching, disabling FortiCloud SSO where feasible, and reviewing authentication/audit logs for anomalous FortiCloud SSO login activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Fortinet started releasing fixed versions and emergency updates for affected products including FortiAnalyzer, FortiManager, FortiOS, and FortiProxy, while additional product impact remained under investigation. The company advised customers to upgrade urgently or disable FortiCloud SSO until patching was complete.
CISA added the Fortinet authentication-bypass flaw to its Known Exploited Vulnerabilities catalog, citing active exploitation. The agency also set a January 30, 2026 remediation deadline for U.S. FCEB agencies and urged defenders to hunt for compromise indicators.
Fortinet published advisory FG-IR-26-060 for CVE-2026-24858 and restored FortiCloud SSO with controls blocking logins from vulnerable product versions. The change made upgrades necessary for customers who wanted to continue using FortiCloud SSO safely.
As an emergency mitigation against ongoing exploitation, Fortinet temporarily disabled FortiCloud SSO on the cloud side for affected devices. This was intended to stop malicious logins while the company prepared broader protections and fixes.
Fortinet said CVE-2026-24858 was exploited in the wild by two attacker-controlled FortiCloud accounts. The company blocked those accounts after observing post-compromise actions such as local admin creation, firewall or VPN changes, and configuration downloads.
Arctic Wolf reported an automated attack cluster targeting FortiGate devices beginning around January 15, 2026. The activity involved rapid account creation, VPN enablement, configuration exfiltration, and techniques resembling earlier SSO-bypass exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcescworld.com
Open sourcecyberscoop.com
Open sourcedarkreading.com
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet has disclosed and patched two critical authentication bypass vulnerabilities, identified as CVE-2025-59718 and CVE-2025-59719, affecting multiple products including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. These flaws, rated with a CVSS score of 9.1, stem from improper verification of cryptographic signatures in the FortiCloud SSO login process. An unauthenticated attacker could exploit these vulnerabilities by sending a crafted SAML message, potentially gaining unauthorized administrative access if FortiCloud SSO is enabled. By default, FortiCloud SSO is disabled, but it is automatically enabled during FortiCare registration unless the administrator explicitly disables the relevant toggle. Fortinet has released fixed versions for all affected products and strongly recommends that organizations upgrade immediately. As a temporary mitigation, disabling the FortiCloud SSO login feature is advised until the upgrade can be completed. There is currently no evidence of exploitation in the wild, and no public proof-of-concept code is available, but the history of threat actors targeting Fortinet products underscores the urgency of patching. The vulnerabilities impact a range of versions across FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, with unaffected versions and upgrade paths detailed in the advisories.
Jun 29, 2026
Two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, have been identified in Fortinet products utilizing the FortiCloud SSO login feature. These flaws stem from improper verification of cryptographic signatures (CWE-347), allowing unauthenticated attackers to bypass SSO authentication and potentially gain administrative access. The vulnerabilities affect multiple Fortinet product lines, including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, when FortiCloud SSO is enabled. Fortinet has clarified that FortiCloud SSO is disabled by default, but it becomes enabled if devices are registered via FortiCare through the GUI unless the relevant setting is manually disabled. Following public disclosure of these vulnerabilities, Arctic Wolf observed active exploitation attempts targeting FortiGate appliances. Malicious SSO logins were traced to several hosting providers, with attackers typically attempting to access the admin account. Indicators of compromise (IOCs) include specific IP addresses from The Constant Company LLC, Bl Networks, and Kaopu Cloud HK Limited. Organizations using affected Fortinet products are urged to review their SSO configurations, apply vendor patches, and monitor for suspicious login activity, especially from the identified IOCs.
Jun 29, 2026
Fortinet has disclosed two critical vulnerabilities, CVE-2025-59718 and CVE-2025-59719, affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager products. These flaws stem from improper verification of cryptographic signatures in the FortiCloud SSO login feature, allowing unauthenticated attackers to bypass authentication by sending crafted SAML response messages. The vulnerabilities are remotely exploitable and impact a wide range of product versions, but the FortiCloud SSO login is not enabled by default unless the device is registered to FortiCare and the feature is explicitly activated. Administrators are strongly advised to disable the FortiCloud SSO login feature if enabled and to apply the latest security updates provided by Fortinet. Additional mitigations include using the device's GUI or CLI to turn off administrative login via FortiCloud SSO. Fortinet also addressed other vulnerabilities in the same advisory, but the authentication bypass flaws pose the most immediate risk due to their critical severity and potential for exploitation in the wild. Organizations should prioritize patching and review their FortiCloud SSO configurations to reduce exposure.
Jun 29, 2026