Loading vulnerability…
CVE-2026-24858 is a critical authentication bypass vulnerability in Fortinet products that implement FortiCloud single sign-on for administrative access. The flaw affects FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy, and FortiWeb in multiple 7.x and 8.x release trains. The issue is classified as Authentication Bypass Using an Alternate Path or Channel and stems from improper handling of the FortiCloud SSO authentication flow, allowing trust to be applied incorrectly across device/account boundaries. An attacker who possesses a FortiCloud account and at least one registered Fortinet device can abuse the vulnerable SSO path to authenticate to other organizations’ devices that are registered to different accounts, provided FortiCloud SSO authentication is enabled on those target devices. The vulnerability has been reported as actively exploited in the wild and has been associated with unauthorized administrative logins, configuration export, and creation of persistence accounts on affected appliances.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Repository contains a small Python helper tool for CVE-2026-24858 described as an “Administrative FortiCloud SSO authentication bypass.” Structure: - cve_2026_24858_tool.py: single CLI utility with two subcommands: - scan: performs an HTTP(S) GET to the target root path “/” (default https/443), then heuristically flags Fortinet devices by checking for “Forti/FortiGate/FortiOS” in the Server header or HTML body and for headers starting with “X-Forti”. Can print headers/body snippet, dump full body, and save response to disk. - exploit: disabled by default; requires --enable-exploit. Reads a local payload file as raw bytes and POSTs it to an operator-specified endpoint on the target using Content-Type: application/octet-stream. Returns HTTP status, headers, and body snippet; can dump/save full response. - README.md: usage examples and warnings; explicitly states the tool does not craft payloads and only sends exact bytes provided. - requirements.txt: requests>=2.25.0. Overall purpose: a conservative scanner plus a generic payload delivery helper for testing a suspected vulnerable Fortinet web management endpoint. It does not implement the auth bypass logic itself; exploitation depends on the user knowing the correct vulnerable path and providing a crafted payload externally.
Repository purpose: a Python proof-of-concept exploit named “SCTT-0004 VORTEX / SCTT-2026-33-0004” claiming a Fortinet/FortiCloud SSO “temporal session collision” that can bypass mitigations for CVE-2026-24858 by repeatedly interacting with the SSO login flow using precisely timed delays across 33 “layers.” Structure: - README.md: High-level claim and usage instructions (run script with <target> and <token>; oscillate for 33 layers). - SCTT-0004-VORTEX.py: Main exploit/PoC implementation. Creates a requests.Session with TLS verification disabled, computes per-layer timing (“temporal resonance”), crafts SAML-assertion-like data structures per layer (NameID, Conditions, AuthnStatement, Fortinet identity attributes), and drives a multi-request sequence intended to cause an identity/session privilege collision. Includes an interactive authorization prompt and prints results. - SCTT-2026-33-0004.json: Metadata describing the claimed vulnerability, mapping to CWE-288/CWE-347, affected versions, and references to CVE-2026-24858 and CVE-2025-59718. - LICENSE: MIT. Exploit capabilities (as implemented/claimed): - Remote, network-based interaction with a FortiCloud/Fortinet SSO endpoint. - Timing-based request orchestration over 33 iterations to attempt authentication bypass / privilege escalation via session-table “collision.” - Post-condition check by requesting an admin resource path to infer elevated access. Notable observables: - Hardcoded relative paths: /remote/saml/login and /admin/dashboard. - SAML/Fortinet attribute URNs embedded in the crafted assertion structure. - No hardcoded C2 infrastructure; target is user-supplied. The code is more consistent with a PoC than a fully weaponized module (no robust target fingerprinting, limited error handling shown in the provided excerpt, and no configurable payload beyond the request sequence).
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
214 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A specific vulnerability listed among the report's analyzed CVEs, but without further detail in the content.
FortiGate vulnerability possibly used in the FortiBleed campaign; described in context as one of the older unpatched flaws enabling authentication bypass and takeover of devices.
Fortinet states this issue may have been used to collect credentials involved in the FortiBleed campaign, but the article provides no technical details about the flaw itself.
A FortiCloud SSO login authentication bypass vulnerability previously exploited in incidents whose stolen credentials are believed to be reused in the FortiBleed campaign.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.