FortiCloud SSO bypass CVE-2026-24858: any FortiCloud account could log in to other customers’ Fortinet devices
Attackers with their own FortiCloud account logged in to other customers’ FortiGates via FortiCloud SSO and added admins. Upgrade, then hunt for rogue admins.
- Published
- Updated
- Ecosystem
- Network edge
- Fixed in
- FortiOS 7.6.6, 7.4.11, 7.2.13, 7.0.19; FortiManager and FortiAnalyzer 7.6.6, 7.4.10, 7.2.12, 7.0.16; FortiProxy 7.6.5, 7.4.13, 7.2.16, 7.0.23; FortiWeb 8.0.4, 7.6.7, 7.4.12; FortiSwitchManager 7.2.9, 7.0.8; FortiNAC-F 7.6.6
- Exploitation
- Yes. Fortinet confirmed abuse by two FortiCloud accounts, locked out on 22 January 2026; in CISA KEV since 27 January 2026
Live scores
CVE-2026-24858- EPSS
- 0.866
very likely to be attacked soon - VEDAS
- 0.975
strong exploit evidence - On CISA KEV
- Yes, since 2026-01-27
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
What happened
FortiCloud SSO lets administrators log in to a Fortinet device with their FortiCloud account. CVE-2026-24858 let an attacker who had any FortiCloud account and a registered device log in to devices registered to other accounts, as long as FortiCloud SSO was enabled on them. Fortinet rates it CVSS 9.8 and confirmed it as exploited (Fortinet PSIRT).
The feature is off in factory settings. It gets turned on when an admin registers the device to FortiCare from the GUI, unless they switch off “Allow administrative login using FortiCloud SSO” on the registration page (Fortinet PSIRT). Many registered devices therefore had it on without anyone choosing it.
The timeline, from Fortinet’s analysis (Fortinet):
- December 2025: Fortinet fixed two earlier FortiCloud SSO bypasses, CVE-2025-59718 and CVE-2025-59719 (FG-IR-25-647).
- January 2026: customers reported unexpected admin logins, some on devices already fully updated. That pointed to a new attack path.
- 22 or 23 January: Fortinet locked out the two FortiCloud accounts used. The advisory says 22 January; the blog says 23 January.
- 26 January: Fortinet turned off FortiCloud SSO on its side.
- 27 January: advisory FG-IR-26-060 published. FortiCloud SSO came back, but no longer accepts logins from devices on vulnerable versions. CISA added the CVE to KEV with a deadline of 30 January (CISA KEV).
- 28 January: Fortinet confirmed that third-party SAML identity providers and FortiAuthenticator are not affected.
After logging in, the attacker downloaded the device configuration and, in almost all cases, created a local admin account so it kept access if the SSO account was disabled (Fortinet). The Hacker News reports the attacker also changed configurations to give those accounts VPN access (The Hacker News).
Am I affected?
Check the version against Fortinet’s table (Fortinet PSIRT):
| Product | Affected | Fixed |
|---|---|---|
| FortiOS | 7.6.0 to 7.6.5, 7.4.0 to 7.4.10, 7.2.0 to 7.2.12, 7.0.0 to 7.0.18 | 7.6.6, 7.4.11, 7.2.13, 7.0.19 |
| FortiManager, FortiAnalyzer | 7.6.0 to 7.6.5, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11, 7.0.0 to 7.0.15 | 7.6.6, 7.4.10, 7.2.12, 7.0.16 |
| FortiProxy | 7.6.0 to 7.6.4, 7.4.0 to 7.4.12, 7.2.0 to 7.2.15, 7.0.0 to 7.0.22 | 7.6.5, 7.4.13, 7.2.16, 7.0.23 |
| FortiWeb | 8.0.0 to 8.0.3, 7.6.0 to 7.6.6, 7.4.0 to 7.4.11 | 8.0.4, 7.6.7, 7.4.12 |
| FortiSwitchManager | 7.2.0 to 7.2.8, 7.0.0 to 7.0.7 | 7.2.9, 7.0.8 |
| FortiNAC-F | 7.6.3 to 7.6.5 | 7.6.6 |
FortiManager Cloud, FortiAnalyzer Cloud and FortiGate Cloud are not affected. Neither are setups that use a custom identity provider, including FortiAuthenticator.
On a FortiGate, check the version and whether FortiCloud SSO login is on:
get system status | grep Version
show full-configuration system global | grep admin-forticloud-sso-loginOn FortiManager and FortiAnalyzer the setting is forticloud-sso under config system saml.
Look for signs of use, even if you are now patched. Fortinet published these indicators (Fortinet PSIRT; Fortinet):
- SSO login accounts:
cloud-noc@mail.io,cloud-init@mail.io,heltaylor.12@tutamail.com,support@openmail.pro. - Admin accounts created by the attacker: names seen include
audit,backup,itadmin,secadmin,support,backupadmin,deploy,remoteadmin,security,svcadminandsystem. Fortinet says the names changed during its analysis, so review every admin account. - Source IPs seen by Fortinet: 104.28.244.114 to .116, 104.28.212.114 and .115, 104.28.195.105 and .106, 104.28.227.105 and .106, 163.61.198.15 and 38.54.6.28 (several are Cloudflare addresses). Seen by third parties: 37.1.209.19 and 217.119.139.50.
- Log entries: an admin login with log ID
0100032001andmethod="sso", for examplemsg="Administrator cloud-init@mail.io logged in successfully from sso(104.28.244.115)", followed by log ID0100044547withcfgpath="system.admin"andaction="Add".
List local admins with show system admin, and search your FortiAnalyzer or syslog store for log ID 0100032001 with method="sso".
What to do now
- Upgrade to a fixed release from the table above. Fortinet says you must upgrade for FortiCloud SSO to work again (Fortinet PSIRT). Its upgrade path tool is at docs.fortinet.com/upgrade-tool.
- Turn off FortiCloud SSO login if you do not use it. On FortiOS and FortiProxy:
config system global,set admin-forticloud-sso-login disable,end. On FortiManager and FortiAnalyzer:config system saml,set forticloud-sso disable,end. - Audit admin accounts and VPN users on every device registered to FortiCloud. Delete accounts you cannot account for.
- If you find any indicator, treat the device as compromised. Fortinet’s steps: restore a known clean configuration or audit it for unauthorised changes, with a focus on admins and VPN settings; rotate credentials, including any LDAP or Active Directory accounts connected to the FortiGate; and open a ticket with Fortinet support (Fortinet). The attacker downloaded configurations, so any secret stored in the config should be considered exposed.
- Take the admin interface off the internet. Fortinet recommends out-of-band management or a local-in policy that limits which source IPs can reach the admin interface (Fortinet).
Why this matters
The flaw sat in how FortiCloud trusted devices, not only in device firmware. That is why Fortinet could cut off abuse centrally on 26 January, before most customers had patched. It also means fully patched devices were taken over before the fix existed, so “we were on the latest version” is not evidence of a clean device.
This is a separate issue from the AI-assisted FortiGate campaign later in 2026, which used exposed admin ports and weak passwords rather than a vulnerability (Vulnpocalypse).