erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: January 27, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: FortiCloud SSO Cross-Account Login: CVE-2026-24858. Owners of FortiGate, FortiProxy, FortiManager, FortiAnalyzer, FortiWeb, FortiNAC-F or FortiSwitchManager appliances that had FortiCloud SSO admin login enabled, which GUI registration to FortiCare turns on by default.
  • Do you run any of these? Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-01-30.
  • npm: 2 critical advisories (@nyariv/sandboxjs, n8n). Check with npm audit (or: npm ls <package>).
  • Go: 1 critical advisory (github.com/kyverno/kyverno). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-24858

FortiCloud SSO Cross-Account Login: CVE-2026-24858

Any Fortinet device that relies on FortiCloud SSO needs the January 2026 builds (FortiCloud now refuses SSO from vulnerable versions anyway), and any device with SSO enabled before then should be checked for rogue admins.

Must act: Owners of FortiGate, FortiProxy, FortiManager, FortiAnalyzer, FortiWeb, FortiNAC-F or FortiSwitchManager appliances that had FortiCloud SSO admin login enabled, which GUI registration to FortiCare turns on by default.

Can relax: FortiManager Cloud, FortiAnalyzer Cloud and FortiGate Cloud are not affected, and neither are setups that use a custom SAML IdP or FortiAuthenticator instead of FortiCloud SSO.

  1. Upgrade every affected Fortinet appliance to the FG-IR-26-060 fixed build for its train; FortiCloud SSO will not work from vulnerable versions.
  2. Audit admin accounts on every device for unexpected local admins (for example audit, backup, itadmin, secadmin, support, svcadmin).
  3. Search logs for SSO logins by the attacker accounts and IPs that Fortinet published.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-24858Fortinet Multiple Products
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability		2026-01-30

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 2

Check: npm audit (or: npm ls <package>)

Go 1

Check: govulncheck ./...