CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-01-27
EPSS: 86.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-27 · updated 2026-06-17
Weakness: CWE-288

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Summary

CVE-2026-24858 is a critical (CVSS 9.8) authentication bypass (CWE-288) in Fortinet products: an attacker with a FortiCloud account and a registered device can log into other devices registered to other accounts when FortiCloud SSO authentication is enabled. It affects FortiAnalyzer, FortiManager, FortiNAC-F, FortiOS, FortiProxy and FortiWeb across the listed version ranges. The flaw is listed in CISA KEV with active exploitation and an EPSS 30-day probability of 86.6%. Apply vendor mitigations or upgrade to the fixed versions (FortiAnalyzer and FortiManager 7.4.10/7.6.6, FortiNAC-F 7.6.6, FortiOS 7.4.11/7.6.6), and follow BOD 22-01 guidance or discontinue use if no mitigation is available.

تُعد CVE-2026-24858 ثغرة تجاوز مصادقة حرجة (CVSS 9.8) من نوع CWE-288 في منتجات Fortinet؛ إذ يستطيع مهاجم يملك حساب FortiCloud وجهازًا مسجلًا تسجيل الدخول إلى أجهزة أخرى مسجلة لحسابات أخرى عند تفعيل مصادقة FortiCloud SSO على تلك الأجهزة. تشمل الثغرة FortiAnalyzer وFortiManager وFortiNAC-F وFortiOS وFortiProxy وFortiWeb ضمن نطاقات الإصدارات المذكورة. الثغرة مدرجة في CISA KEV مع استغلال نشط واحتمال استغلال خلال 30 يومًا بنسبة 86.6% وفق EPSS. طبّق إرشادات التخفيف من المورد أو حدّث إلى الإصدارات المصلحة (FortiAnalyzer وFortiManager 7.4.10/7.6.6، وFortiNAC-F 7.6.6، وFortiOS 7.4.11/7.6.6)، واتبع توجيه BOD 22-01 أو أوقف استخدام المنتج إن لم يتوفر تخفيف.

Affected products

Fortinet FortiAnalyzer: from 7.0.0 through 7.0.15; from 7.2.0 through 7.2.11; from 7.4.0 before 7.4.10; from 7.6.0 before 7.6.6 — fixed in 7.4.10, 7.6.6
Fortinet FortiManager: from 7.0.0 through 7.0.15; from 7.2.0 through 7.2.11; from 7.4.0 before 7.4.10; from 7.6.0 before 7.6.6 — fixed in 7.4.10, 7.6.6
Fortinet FortiNAC-F: from 7.6.3 before 7.6.6 — fixed in 7.6.6
Fortinet FortiOS (FortiGate): from 7.0.0 through 7.0.18; from 7.2.0 through 7.2.12; from 7.4.0 before 7.4.11; from 7.6.0 before 7.6.6 — fixed in 7.4.11, 7.6.6
Fortinet FortiProxy: from 7.0.0 through 7.0.22; from 7.2.0 through 7.2.15; from 7.4.0 through 7.4.12; from 7.6.0 through 7.6.4
Fortinet FortiWeb: from 7.4.0 through 7.4.11; from 7.6.0 through 7.6.6; from 8.0.0 through 8.0.3
Siemens Ruggedcom Ape1808 Firmware: all versions

How to fix

Upgrade to a fixed version: Fortinet FortiAnalyzer 7.4.10, 7.6.6; Fortinet FortiManager 7.4.10, 7.6.6; Fortinet FortiNAC-F 7.6.6; Fortinet FortiOS (FortiGate) 7.4.11, 7.6.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-24858 or the next vulnerability affects your stack