Authentication Bypass in Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy (CVE‑2026‑24858) Enables Cross‑Account Access via FortiCloud SSO
What It Is — Fortinet’s FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication‑bypass flaw that can be triggered through an alternate path when FortiCloud Single Sign‑On (SSO) is enabled. An attacker who possesses a valid FortiCloud account and a registered device may log into other Forti devices that are registered to different FortiCloud accounts.
Exploitability — The vulnerability is publicly disclosed (CVE‑2026‑24858) and has a CVSS v3.1 base score of 8.8 (High). Exploits are feasible without prior access to the target device, provided the attacker can authenticate to FortiCloud. No public PoC is required; the attack leverages legitimate SSO flows.
Affected Products — FortiAnalyzer, FortiManager, FortiOS, FortiProxy (all versions supporting FortiCloud SSO).
Why It Matters for Trust & Control Assurance
- Identity & Access Management control – The flaw demonstrates how an alternate authentication channel can undermine the assurance that only authorized users can access critical network infrastructure.
- Continuous monitoring – Detecting unauthorized cross‑account logins requires robust log collection and correlation, a key evidence source for audit readiness.
- Defensible audit trail – Enterprises must be able to prove that authentication mechanisms were not bypassed, which calls for documented SSO configuration reviews and evidence of timely patching.
Recommended Actions
- Apply Fortinet’s patch for CVE‑2026‑24858 immediately.
- Temporarily disable FortiCloud SSO on all devices until the patch is verified.
- Enforce MFA for all FortiCloud accounts and review device registration policies.
- Audit recent authentication logs for any cross‑account access attempts and retain evidence for compliance reporting.
- Update your access‑control policies to include verification of alternate authentication paths.
Source: CISA KEV – CVE‑2026‑24858