DaystoPatch

FortinetExploited incident

FortiCloud SSO authentication bypass used against fully patched FortiGates

CVE-2026-24858Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 27 Jan 2026

  • Exploited before a fix
FixedFirst fix 8 days after the first public report. No evidence yet of when every version was fixed.
Embed this live clock

Response

Silence
2d
First public report to first vendor statement
Exposure
8d
First public report to first fix
Follow-through
not dated
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Help Net Security (reporting an Arctic Wolf engineer's X post)CuratedQuote verified

    Also on Tuesday, Reid Hutchins, a security engineer at Arctic Wolf, shared on X that they “have observed multiple compromises of fully patched Fortinet firewalls in the last 24 hours that exhibit behavior similar to a CVE disclosed last December.

    Article dated Wednesday January 21, 2026, so 'Tuesday' is 2026-01-20. The same article reports a Reddit post that Tuesday from an admin whose FortiGate on 7.4.9 was hit. Neither the X post nor the Reddit thread could be fetched directly. Arctic Wolf told Help Net Security the activity began on 2026-01-15.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:042ad6205c264967…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Help Net SecurityCuratedQuote verified21 Jan 2026

    Fully patched FortiGate firewalls are getting compromised via CVE-2025-59718?

    Headline of the article dated January 21, 2026; first news report found.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:042ad6205c264967…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet advisory FG-IR-26-060ClaimedQuote verified27 Jan 2026

    Administrative FortiCloud SSO authentication bypass

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-26-060 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f064d00cbd54ad1f…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-24858)ClaimedQuote verified27 Jan 2026

    Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

    Added to CISA's KEV catalog on 2026-01-27.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-24858ClaimedQuote verified27 Jan 2026, 19:18 UTC

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d7845a9866257fe7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet27 Jan 2026, 20:17 UTC

    🔴 CVE-2026-24858 - Critical (9.8)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet29 Jan 2026, 20:39 UTC

    and, well . . . # Fortinet # FortinetSSO # CVE # CVE202624858 https://www. esecurityplanet.com/threats/fo rtinet-confirms-cve-2026-24858-sso-flaw-under-active-attack

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date only+2d

    Fortinet PSIRT blog 'Analysis of Single Sign-On Abuse on FortiOS' (Wayback snapshot 2026-01-23 10:43 UTC)CuratedQuote verified

    we have identified a number of cases where the exploit was to a device that had been fully upgraded to the latest release at the time of the attack, which suggested a new attack path.

    Blog byline 'By Carl Windsor | January 22, 2026'. First vendor acknowledgement; the advisory with a CVE followed on 2026-01-27.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4612c3a460af93bd…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Fortinet PSIRT FG-IR-26-060CuratedQuote not checked yet27 Jan 2026

    2026-01-27: Initial publication

    Source
    Fortinet PSIRT FG-IR-26-060 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE record CVE-2026-24858 (CNA: Fortinet)CuratedQuote verified27 Jan 2026, 19:18 UTC

    "datePublished":"2026-01-27T19:18:23.591Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d7845a9866257fe7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date only+2d

    Fortinet PSIRT blog (Wayback snapshot 2026-01-23 10:43 UTC)CuratedQuote verified

    As an additional workaround we recommend disabling the FortiCloud SSO feature.

    Customer-side workaround in the first version of the blog (dated January 22, 2026), alongside a local-in policy restricting admin access. Fortinet also acted server-side: abusive FortiCloud accounts disabled 2026-01-22/23 and FortiCloud SSO disabled for everyone on 2026-01-26, re-enabled 2026-01-27 for fixed versions only.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4612c3a460af93bd…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date only+8d

    Fortinet PSIRT FG-IR-26-060 (Wayback snapshot 2026-01-28 02:01 UTC)CuratedQuote verified

    Upgrade to 7.4.11 or above

    The snapshot at 2026-01-27 22:53 UTC still lists every fix as 'upcoming' (FortiOS 7.4: 'Upgrade to upcoming 7.4.11 or above'); by 2026-01-28 02:01 UTC FortiOS 7.4.11 and FortiManager/FortiAnalyzer 7.4.10 are listed as available, so the first fixes appeared between those two captures. The advisory's own timeline was never updated beyond initial publication. Help Net Security (2026-01-28): 'Fortinet starts patching exploited FortiCloud SSO zero-day'. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c5d02cafb7d9694a…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    No evidence yet of fixed releases for every supported branch.

This advisory changed after publication

  1. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 2 rows added and 1 row removed. One new row reads "FortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above".

    • Fixed versions
    Version table rows
    BeforeFortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to upcoming 7.0.8 or above
    AfterFortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above; FortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to 7.0.8 or above
    Verbatim wording. Removed text is struck through. Added text is bold.
    Before

    or above FortiProxy 7.0 | 7.0.0 through 7.0.22 | Upgrade to 7.0.23 or above FortiSwitchManager 7.2 | 7.2.0 through 7.2.8 | Upgrade to 7.2.9 or above FortiSwitchManager 7.0 | 7.0.0 through 7.0.7 | Upgrade to upcoming 7.0.8 or above FortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to 8.0.4 or above FortiWeb 7.6 | 7.6.0 through 7.6.6 | Upgrade to 7.6.7 or above FortiWeb 7.4 | 7.4.0 through 7.4.11 | Upgr

    After

    11 | Upgrade to 7.2.12 or above FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above FortiManager 6.4 | Not affected | Not Applicable FortiNAC-F 7.6 | 7.6.3 through 7.6.5 | Upgrade to 7.6.6 or above FortiNAC-F 7.4 | Not affected | Not Applicable FortiNAC-F 7.2 | Not affected | Not Applicable FortiOS 8.0 | Not affected | Not Applicable FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to

    Earlier version captured 21 Feb 2026, 11:20 UTC: archived copyLater version captured 9 Jul 2026, 15:43 UTC: archived copyRecovered from archived copiesSnapshots e4573e1a2f… and 9cdc135f0c…Incident page

  2. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 15 rows added and 13 rows removed. One new row reads "FortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above".

    • Fixed versions
    Version table rows
    BeforeFortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiAnalyzer 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming 7.0.16 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to upcoming
    AfterFortiAnalyzer 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above; FortiAnalyzer 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to 7.2.12 or above; FortiManager 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above
    Earlier version captured 3 Feb 2026, 01:15 UTC: archived copyLater version captured 21 Feb 2026, 11:20 UTC: archived copyRecovered from archived copiesSnapshots 808d80ebbc… and e4573e1a2f…Incident page

  3. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 6 rows added and 4 rows removed. One new row reads "FortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above".

    • Fixed versions
    Version table rows
    BeforeFortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above; FortiManager 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.13 or above; FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to upcoming 7.6.6 or a
    AfterFortiAnalyzer 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above; FortiManager 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above; FortiManager 7.2 | 7.2.0 through 7.2.11 | Upgrade to upcoming 7.2.12 or above; FortiOS 7.6 | 7.6.0 through 7.6.5 | Upgrade to 7.6.6 or above
    Earlier version captured 29 Jan 2026, 07:12 UTC: archived copyLater version captured 31 Jan 2026, 13:18 UTC: archived copyRecovered from archived copiesSnapshots 489f6a4225… and 6e2496bb6a…Incident page

  4. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 3 rows added. One new row reads "FortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to upcoming 8.0.4 or above".

    • Fixed versions
    Version table rows
    Beforenot present
    AfterFortiWeb 8.0 | 8.0.0 through 8.0.3 | Upgrade to upcoming 8.0.4 or above; FortiWeb 7.6 | 7.6.0 through 7.6.6 | Upgrade to upcoming 7.6.7 or above; FortiWeb 7.4 | 7.4.0 through 7.4.11 | Upgrade to upcoming 7.4.12 or above
    Earlier version captured 28 Jan 2026, 02:01 UTC: archived copyLater version captured 28 Jan 2026, 19:27 UTC: archived copyRecovered from archived copiesSnapshots 8cd7570427… and 39cba51206…Incident page

  5. FG-IR-26-060

    Changed without a revision note

    Administrative FortiCloud SSO authentication bypass

    Version table: 3 rows added and 3 rows removed. One new row reads "FortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above". Workaround text changed.

    • Fixed versions
    • Workaround
    Version table rows
    BeforeFortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to upcoming 7.4.10 or above; FortiManager 7.4 | 7.4.0 through 7.4.9 | Upgrade to upcoming 7.4.10 or above; FortiOS 7.4 | 7.4.0 through 7.4.10 | Upgrade to upcoming 7.4.11 or above
    AfterFortiAnalyzer 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above; FortiManager 7.4 | 7.4.0 through 7.4.9 | Upgrade to 7.4.10 or above; FortiOS 7.4 | 7.4.0 through 7.4.10 | Upgrade to 7.4.11 or above
    Workaround
    BeforeFortiCloud SSO authentication no longer supports login from devices running vulnerable versions. Therefore disabling FortiCloud SSO login on client side is not necessary at the moment. For reference, it can be nonetheless be done via the following: go to System -> Settings -> Switch "Allow administr
    AfterFortiCloud SSO authentication no longer supports login from devices running vulnerable versions. Therefore disabling FortiCloud SSO login on client side is not necessary at the moment. For reference, it can be nonetheless be done via the following: On FortiOS and FortiProxy: go to System -> Settings
    Earlier version captured 27 Jan 2026, 22:53 UTC: archived copyLater version captured 28 Jan 2026, 02:01 UTC: archived copyRecovered from archived copiesSnapshots 9a28e614bf… and 8cd7570427…Incident page

Send this to your boss

FortiCloud SSO login bypass hit patched Fortinet devices; fixes Jan 28 to Feb

Attackers with their own FortiCloud accounts logged into other customers' Fortinet devices, including fully patched ones, and Fortinet shipped fixes in stages from 28 January 2026.

In plain words

Attackers found a way to log into Fortinet firewalls and management systems through Fortinet's cloud sign-on feature, even on devices that were fully up to date, and used it to create backdoor admin accounts and copy configurations. Fortinet blocked the abuse on its cloud side on 26-27 January 2026 and released fixed versions between 28 January and late February. If we use Fortinet devices with cloud sign-on enabled, we need to be on the fixed versions and check them for unknown admin accounts.

What happened and who is affected

What happened

From mid-January 2026 attackers logged into FortiGate firewalls through FortiCloud single sign-on, created admin accounts and copied configurations, even on devices patched for the December 2025 SSO flaw. Fortinet confirmed a new attack path on 22 January, blocked FortiCloud SSO for vulnerable devices on 26-27 January, and published CVE-2026-24858 on 27 January before any fixed release existed. Fixed versions arrived in stages: FortiOS 7.4.11 by 28 January, 7.6.6 by 31 January and the remaining FortiOS, FortiManager, FortiAnalyzer, FortiProxy and FortiWeb lines by 21 February 2026.

Who is affected

Devices with FortiCloud SSO administrative login enabled (often switched on when a device is registered to FortiCare from its GUI): FortiOS 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.12, 7.0.0-7.0.18; FortiManager and FortiAnalyzer 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.12, 7.2.0-7.2.15, 7.0.0-7.0.22; FortiWeb 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11; FortiSwitchManager 7.2.0-7.2.8, 7.0.0-7.0.7; FortiNAC-F 7.6.3-7.6.5.

CVE-2026-24858. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/fortinet-cve-2026-24858/

Affected products

  • FortiOS
  • FortiManager
  • FortiAnalyzer
  • FortiProxy
  • FortiSwitchManager
  • FortiWeb
  • FortiNAC-F
How we built this timeline

Zero-day for customers: exploitation of fully patched devices was public on 20 Jan 2026/21 and acknowledged by Fortinet on 22 Jan 2026; the advisory (27 Jan 2026) listed only 'upcoming' fixed versions. Staggered fixes reconstructed from Wayback captures of FG-IR-26-060 (the advisory timeline only shows initial publication): by 28 Jan 2026 02:01Z FortiOS 7.4.11, FortiManager/FortiAnalyzer 7.4.10; between 29 Jan 2026 07:12Z and 31 Jan 2026 13:18Z FortiOS/FortiManager/FortiAnalyzer 7.6.6; between 3 Feb 2026 01:15Z and 21 Feb 2026 11:20Z FortiOS 7.2.13/7.0.19, FortiManager/FortiAnalyzer 7.2.12/7.0.16, FortiProxy 7.6.5/7.4.13/7.2.16/7.0.23, FortiWeb 8.0.4/7.6.7/7.4.12;

FortiSwitchManager 7.0.8 still 'upcoming' on 21 Feb 2026 and listed as available by 9 Jul 2026 (no capture in between). Fixed for all versions is therefore omitted rather than estimated.

Conflict: Fortinet's blog says 'January 30: Fortinet updated the Public Advisory with the last of the release updates', but the 31 Jan 2026 and 3 Feb 2026 captures still show 13 'upcoming' rows. FortiProxy 7.2/7.0 were initially 'Migrate to a fixed release' and later got fixed versions.

Distinct from CVE-2025-59718 (fortinet-cve-2025-59718).

Related

Fortinet report card