CVE-2026-24858 let attackers log into Fortinet devices registered to other customers

The two 2025 bugs were signature problems. CVE-2025-59718 and CVE-2025-59719 are classified CWE-347, improper verification of a cryptographic signature, and were abused with a crafted SAML message ^[4]. CVE-2026-24858 is CWE-288, authentication bypass using an alternate path or channel ^[1]. Different weakness class, different code path, so the release that fixed the SAML handling left the new route open ^[4]. Fortinet observed the malicious activity on devices that had been fully upgraded at the time of exploitation ^[5].

An attacker needs a FortiCloud account and one registered device of their own. From there they can log in to devices registered to other users wherever FortiCloud SSO is enabled ^[2].

The affected product list also moved: FortiManager and FortiAnalyzer are in scope for the new bug and were not in the earlier advisory, while FortiSwitch Manager appears only in the 2025 pair ^[1].

Arctic Wolf Labs posted its observation of malicious configuration changes on FortiGate devices via SSO accounts on January 21 ^[12]. Fortinet's Carl Windsor published "Analysis of Single Sign-On Abuse on FortiOS" on January 22 ^[13]. Fortinet disabled all FortiCloud SSO authentication on January 26 and reinstated it on January 27 with changes to prevent exploitation of vulnerable devices, according to the company ^[6]. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day ^[7], six days after the Arctic Wolf post ^[3], and issued guidance on January 28 ^[9]. The advisory that covered the first two bypasses, FG-IR-25-647, was last modified on December 9, 2025, fifty days before that guidance ^[11][2].

What the January 27 change does is stop further exploitation of vulnerable devices ^[6]. Accounts created during the exploitation window, and the VPN configuration written to grant those accounts access, stay where they are until an operator removes them ^[7]. Fortinet reported three actions on upgraded devices: unauthorized firewall configuration changes on FortiGate, unauthorized account creation, and unauthorized VPN changes granting access to the new accounts ^[5].

CISA's instruction is to check for indicators of compromise on all internet-accessible affected Fortinet products and to apply updates immediately as soon as they are available, following Fortinet's instructions ^[8]. The wording puts the device-level patch in the future tense; the mitigation that is already in force was applied by Fortinet, not by customers ^[6]. Fortinet's advisory for the new bug, FG-IR-26-060, was last modified on January 27, the day the service came back and the day the CVE entered KEV ^[10][7].