---
title: "Security digest: January 27, 2026"
url: https://erroneo.us/security/2026-01-27/
description: "January 27, 2026 vulnerability digest: 1 brief (FortiCloud SSO Cross-Account Login: CVE-2026-24858); 1 CISA KEV addition (Fortinet); 3 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-01-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: January 27, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 3 critical advisories.

## Take stock

- Act now: FortiCloud SSO Cross-Account Login: CVE-2026-24858 . Owners of FortiGate, FortiProxy, FortiManager, FortiAnalyzer, FortiWeb, FortiNAC-F or FortiSwitchManager appliances that had FortiCloud SSO admin login enabled, which GUI registration to FortiCare turns on by default.
- Do you run any of these? Fortinet Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-01-30.
- npm: 2 critical advisories ( @nyariv/sandboxjs , n8n ). Check with npm audit (or: npm ls <package>) .
- Go: 1 critical advisory ( github.com/kyverno/kyverno ). Check with govulncheck ./... .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Act now** [FortiCloud SSO Cross-Account Login: CVE-2026-24858](https://erroneo.us/security/briefs/forticloud-sso-cross-account-bypass-cve-2026-24858/index.md): Any Fortinet device that relies on FortiCloud SSO needs the January 2026 builds (FortiCloud now refuses SSO from vulnerable versions anyway), and any device with SSO enabled before then should be checked for rogue admins.

## Known exploited (CISA KEV)

- [CVE-2026-24858](https://erroneo.us/security/cve/CVE-2026-24858/index.md) Fortinet Multiple Products: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability (CISA due 2026-01-30)

## Critical advisories

- [CVE-2026-23830](https://erroneo.us/security/cve/CVE-2026-23830/index.md) SandboxJS has Sandbox Escape via Unprotected AsyncFunction Constructor — npm @nyariv/sandboxjs < 0.8.26 → 0.8.26
- [CVE-2026-22039](https://erroneo.us/security/cve/CVE-2026-22039/index.md) Kyverno Cross-Namespace Privilege Escalation via Policy apiCall — Go github.com/kyverno/kyverno < 1.15.3 → 1.15.3; Go github.com/kyverno/kyverno >= 1.16.0-rc.1, < 1.16.3 → 1.16.3
- [CVE-2026-1470](https://erroneo.us/security/cve/CVE-2026-1470/index.md) n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution — npm n8n < 1.123.17 → 1.123.17; npm n8n >= 2.0.0, < 2.4.5 → 2.4.5; npm n8n >= 2.5.0, < 2.5.1 → 2.5.1

---
Source page: https://erroneo.us/security/2026-01-27/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt