CVE-2026-24858

Published Jan 27, 2026

Last updated 3 months ago

Exploit known CVSS critical 9.8

Fortinet

Network

API

Supply chain

VPN

Firmware

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-24858 is an authentication bypass vulnerability, categorized as CWE-288 (Authentication Bypass Using an Alternate Path or Channel), affecting several Fortinet products including FortiAnalyzer, FortiManager, FortiOS, FortiProxy, and FortiWeb across various versions. The flaw resides within the FortiCloud Single Sign-On (SSO) login mechanism. This vulnerability allows an attacker who possesses their own FortiCloud account and a registered device to gain unauthorized access to other devices registered to different accounts, provided that FortiCloud SSO authentication is enabled on those target devices. Although FortiCloud SSO is not enabled by default, it can be automatically activated when an administrator registers a device to FortiCare through the graphical user interface, unless explicitly disabled during the registration process. Once access is gained, threat actors have been observed creating local administrative accounts, altering configurations to enable VPN access, and exfiltrating sensitive firewall configuration data.

Description: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortianalyzer, fortimanager, fortiproxy, fortiweb, fortios

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Exploit added on: Jan 27, 2026
Exploit action due: Jan 30, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@fortinet.com: CWE-288

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F2B61F1F-19A9-4BA6-B12A-ECA95C5634A3",
            "versionEndIncluding": "7.0.15",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D467D1D8-1BCF-4A88-8EEE-0D8092C3AE9C",
            "versionEndIncluding": "7.2.11",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BD96750D-104E-4DAE-A19E-8C92E85429F4",
            "versionEndExcluding": "7.4.10",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BDF7BF56-B998-4AAE-9B6D-C6F009F8B807",
            "versionEndExcluding": "7.6.6",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "651E452B-3C1D-4738-BDFF-7234B19C63F7",
            "versionEndIncluding": "7.0.15",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "36D9D75F-B292-4651-8BF0-20AFE2C016C4",
            "versionEndIncluding": "7.2.11",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3AF70FA9-34D3-4ADF-B87C-A9C31D4DC174",
            "versionEndExcluding": "7.4.10",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "357DA889-E7C0-42B6-96A5-83C0D9E6CC69",
            "versionEndExcluding": "7.6.6",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "63D22275-D430-4F99-9170-C8378FF80242",
            "versionEndIncluding": "7.0.22",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "33FE9C6F-F5A1-43E4-917E-32497D6CC5A6",
            "versionEndIncluding": "7.2.15",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "DA34D10C-0B80-4A37-94D2-CD05E865E149",
            "versionEndIncluding": "7.4.12",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A26D8D81-00EE-4A11-B693-DE85B912F267",
            "versionEndIncluding": "7.6.4",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "64C16483-DF84-43AA-B5D4-FA8939E4F387",
            "versionEndIncluding": "7.4.11",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "B40750AD-AE67-42C3-89A5-E64F3D7F0431",
            "versionEndIncluding": "7.6.6",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EDCDD451-D984-4EC9-AB30-42D553FF0BD7",
            "versionEndIncluding": "8.0.3",
            "versionStartIncluding": "8.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6A0CDFB7-0B78-4B3E-9E19-34E5F2479271",
            "versionEndIncluding": "7.0.18",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "25DF0315-DF9C-4C51-9902-ED607B049152",
            "versionEndIncluding": "7.2.12",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2ADAF67E-132B-4810-8919-38AC80BF59F5",
            "versionEndExcluding": "7.4.11",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "96C45B06-625A-4EFE-A720-242E33611B50",
            "versionEndExcluding": "7.6.6",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.