CVE-2026-24858: Critical FortiCloud SSO Authentication Bypass (Active In-The-Wild Exploitation)

HERMES

HERMES THREAT SCORE & CISA KEV ACTIVE INTRUSION PROFILE

Target: Fortinet FortiOS, FortiManager & FortiAnalyzer (FortiCloud SSO Handshake)

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 19 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Hermes assigns an emergency rating to CVE-2026-24858 (HTS 98 / CRITICAL). Added immediately to the CISA Known Exploited Vulnerabilities (KEV) catalog, this vulnerability allows any threat actor with a registered FortiCloud account to log into external target appliances where FortiCloud SSO is enabled, completely subverting administrative access controls.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-24858: Critical FortiCloud SSO Authentication Bypass (Active In-The-Wild Exploitation)VULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTFortinet FortiOS Gateway

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Fortinet FortiOS Gateway documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV / Critical FortiCloud SSO Authentication Bypass

CVSS v3.1: 9.4 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-288: Authentication Bypass Using an Alternate Path or Channel.
Confirmed Active Exploitation in the Wild (CISA KEV). An unauthenticated attacker possessing any valid FortiCloud account and registered device can forge SSO token assertions to authenticate as an administrator on third-party FortiOS, FortiManager, FortiAnalyzer, and FortiProxy deployments with FortiCloud SSO enabled. Patched in FortiOS 7.4.5, 7.2.9, and 7.6.0.

Executive Summary

CISA and Fortinet issued emergency directives concerning CVE-2026-24858, an actively exploited authentication bypass mechanism affecting the FortiCloud Single Sign-On (SSO) integration across Fortinet’s core appliance ecosystem.

When FortiCloud SSO is activated on an appliance, the local device delegates administrator authentication to cloud identity assertions. Due to a failure in validating tenant binding between the issuing FortiCloud account and the targeted device registration, an attacker possessing an arbitrary FortiCloud account can log directly into victim appliances across the Internet without local credentials.

---

1. Metadata & Threat Intelligence Surface

Metric	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-24858	Standardized vulnerability identifier
CISA KEV Status	Active Exploitation Confirmed	Mandatory federal patching directive
Vendor / Advisory	Fortinet / FG-IR-26-062	Emergency security bulletin
Affected Products	FortiOS, FortiManager, FortiAnalyzer, FortiProxy	Central management and edge security
Affected Releases	FortiOS 7.4.0–7.4.4, 7.2.0–7.2.8	Enterprise firewall firmware
Fixed Releases	FortiOS 7.4.5, 7.2.9, 7.6.0	Official vendor security fixes
Associated CWE	CWE-288: Alternate Path Authentication Bypass	Total authorization subversion
EPSS Score	94.2% (Percentile: 99.8%)	Imminent mass weaponization
Threat Actor Activity	Nation-State Espionage & Ransomware Pre-access	Initial access broker exploitation

---

2. Technical Root Cause Analysis

The flaw lies in the token verification logic implemented in httpsd when validating OAuth2/OpenID Connect tokens returned from FortiCloud SSO servers:

CVE-2026-24858 SSO Authentication Bypass Architecture:

  ┌────────────────────────────────────────────────────────┐
  │ Threat Actor (Legitimate Free FortiCloud Account)      │
  └───────────────────────────┬────────────────────────────┘
                              │ 1. Completes legitimate SSO flow on adversary account
                              │ 2. Receives valid FortiCloud OIDC Identity Token
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Token Relay to Victim Appliance                        │
  │ POST /api/v2/authentication/sso/login                  │
  │ Token: { iss: "forticloud", sub: "attacker_account" }   │
  └───────────────────────────┬────────────────────────────┘
                              │
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Victim FortiOS / FortiManager Appliance                │
  │ - Validates token signature against FortiCloud CA: OK  │
  │ - FAILS TO VERIFY that the tenant ID matches its own!  │
  │ - Maps session to superadmin profile                   │
  └────────────────────────────────────────────────────────┘

The appliance validated that the token was signed by the official FortiCloud Certificate Authority, but failed to cross-reference the device’s own serial number or registered company account ID (account_id) against the claims in the token payload. Consequently, any signed token was accepted as valid.

---

3. Forensic Detection & Incident Response

FortiOS Audit Log Signatures

Search for administrative logins originating from unfamiliar FortiCloud email accounts in system event logs:

date=2026-04-12 time=03:14:22 devname="FG-HQ-FW01" logid="0100032001"
type="event" subtype="system" level="information" logdesc="Admin login successful"
user="cloud-sso-login" ui="https(198.51.100.77)" method="forticloud-sso"
action="login" status="success" reason="none" msg="Administrator logged in via FortiCloud SSO"

Emergency Temporary Workaround

If an immediate firmware upgrade cannot be applied during a change freeze, disable FortiCloud SSO authentication immediately:

config system global
    set forticloud-sso disable
end

---

4. Remediation & Hardening Playbook

1. Immediate Firmware Patching:
   Upgrade FortiOS appliances to 7.4.5, 7.2.9, or 7.6.0. Upgrade FortiManager and FortiAnalyzer to 7.4.6 or 7.2.8.
2. Disable FortiCloud SSO on Public Interfaces:
   Ensure that administrative web access is never permitted over WAN-facing interfaces.
3. Audit Administrative Accounts & API Tokens:
   Inspect local administrators and API keys generated following unauthorized SSO sessions:

   show system admin
   show system api-user