erroneo.us
Search all guides⌘K

Security Digest · Jan 27, 2026 · Vulnerability · Network edge

FortiCloud SSO Cross-Account Login: CVE-2026-24858

A FortiCloud account plus a registered device let attackers log into other customers' Fortinet gear with FortiCloud SSO on. Exploited zero-day; upgrade.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Act now

Any Fortinet device that relies on FortiCloud SSO needs the January 2026 builds (FortiCloud now refuses SSO from vulnerable versions anyway), and any device with SSO enabled before then should be checked for rogue admins.

Who must act: Owners of FortiGate, FortiProxy, FortiManager, FortiAnalyzer, FortiWeb, FortiNAC-F or FortiSwitchManager appliances that had FortiCloud SSO admin login enabled, which GUI registration to FortiCare turns on by default.

Who can relax: FortiManager Cloud, FortiAnalyzer Cloud and FortiGate Cloud are not affected, and neither are setups that use a custom SAML IdP or FortiAuthenticator instead of FortiCloud SSO.

Affected
FortiOS 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.12, 7.0.0-7.0.18
FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.12, 7.2.0-7.2.15, 7.0.0-7.0.22
FortiManager and FortiAnalyzer 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15
FortiWeb 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11
FortiNAC-F 7.6.3-7.6.5
FortiSwitchManager 7.2.0-7.2.8, 7.0.0-7.0.7
Fixed in
FortiOS 7.6.6, 7.4.11, 7.2.13, 7.0.19
FortiProxy 7.6.5, 7.4.13, 7.2.16, 7.0.23
FortiManager / FortiAnalyzer 7.6.6, 7.4.10, 7.2.12, 7.0.16
FortiWeb 8.0.4, 7.6.7, 7.4.12
FortiNAC-F 7.6.6
FortiSwitchManager 7.2.9, 7.0.8
CVSS
9.8 (v3.1, vendor)
EPSS
85.8% (percentile 99.7)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Upgrade every affected Fortinet appliance to the FG-IR-26-060 fixed build for its train; FortiCloud SSO will not work from vulnerable versions.
  2. Audit admin accounts on every device for unexpected local admins (for example audit, backup, itadmin, secadmin, support, svcadmin).
  3. Search logs for SSO logins by the attacker accounts and IPs that Fortinet published.
  4. If you find indicators, restore a known-clean config, then rotate admin, VPN and LDAP/AD credentials stored on the device.
  5. Restrict administrative access to trusted networks with a local-in policy, and consider leaving FortiCloud SSO disabled if you don't need it.

How to check if you are affected or compromised

  • Look for logid 0100032001 SSO admin logins from cloud-noc@mail.io, cloud-init@mail.io, heltaylor.12@tutamail.com or support@openmail.pro.
  • Look for logid 0100044547 'Add system.admin' events creating a super_admin account right after an SSO login.
  • Check for logins or traffic from the IPs in FG-IR-26-060, such as 104.28.244.115, 104.28.212.114, 163.61.198.15 and 38.54.6.28.
  • Check for configuration file downloads by SSO users.

What happened#

In January 2026, Fortinet customers began reporting unexpected admin logins that looked like the FortiCloud SSO bypass patched a month earlier (CVE-2025-59718/59719). Some of the affected devices were fully upgraded. In a PSIRT blog post dated January 22, Fortinet said this pointed to a new attack path. On January 27, it published FG-IR-26-060 for CVE-2026-24858, an authentication bypass using an alternate path (CWE-288).

The flaw let an attacker who held a FortiCloud account and a registered device log into devices registered to other accounts, provided those devices had FortiCloud SSO enabled. Fortinet says two malicious FortiCloud accounts were exploiting it in the wild. It locked those accounts out on January 22, switched FortiCloud SSO off globally on January 26, and turned it back on January 27 with logins from vulnerable versions refused. CISA added the CVE to KEV the same day, with a January 30 deadline. Fortinet and NVD list CVSS 3.1 9.8.

Who is affected#

The flaw reaches further than the December bug. It covers FortiOS 7.0-7.6, FortiProxy 7.0-7.6, FortiManager and FortiAnalyzer 7.0-7.6, FortiWeb 7.4-8.0, FortiNAC-F 7.6.3-7.6.5 and FortiSwitchManager 7.0/7.2. FortiOS 8.0 and FortiManager 8.0 are listed as not affected. As before, FortiCloud SSO is off in factory settings but is switched on when a device is registered to FortiCare from the GUI, unless the admin turns off the toggle. FortiManager Cloud, FortiAnalyzer Cloud and FortiGate Cloud are not affected. Setups that use a custom SAML IdP, including FortiAuthenticator, are also not affected. Fortinet confirmed that point on January 28 after first warning that the issue applied to all SAML SSO implementations.

Do you really need to act?#

Yes, if you use or ever enabled FortiCloud SSO. This was a zero-day that defeated a recent patch, needed nothing from the victim, and gave attackers super_admin access. Fortinet describes the attacker's main operations as downloading the customer's config file and adding an admin account for persistence. Its server-side change limits the risk of new exploitation of unpatched devices, because FortiCloud SSO no longer accepts logins from vulnerable versions. That does nothing about access the attacker already set up. A local admin account created in January still works today.

Devices that never had FortiCloud SSO enabled, or that use a third-party IdP or FortiAuthenticator, were not exposed. They still belong on your normal patch schedule.

What to do now#

  1. Upgrade to the fixed builds: FortiOS 7.6.6, 7.4.11, 7.2.13 or 7.0.19, FortiProxy 7.6.5, 7.4.13, 7.2.16 or 7.0.23, FortiManager/FortiAnalyzer 7.6.6, 7.4.10, 7.2.12 or 7.0.16, FortiWeb 8.0.4, 7.6.7 or 7.4.12, FortiNAC-F 7.6.6, and FortiSwitchManager 7.2.9 or 7.0.8.
  2. If you don't need FortiCloud SSO, disable it. On FortiOS and FortiProxy run config system global, set admin-forticloud-sso-login disable, end. On FortiManager and FortiAnalyzer run config system saml, set forticloud-sso disable, end.
  3. Run show system admin and remove any account you cannot explain.
  4. Apply a local-in policy so only management subnets can reach HTTPS admin.
  5. If you find indicators, follow Fortinet's post-exploitation steps. Restore a known-clean configuration, audit VPN users and settings, and rotate every credential on the device, including LDAP/AD accounts.

How to tell if you were hit#

Fortinet's indicators are the SSO users cloud-noc@mail.io, cloud-init@mail.io, heltaylor.12@tutamail.com and support@openmail.pro, and the login IPs 104.28.244.115, 104.28.212.114, 104.28.212.115, 104.28.195.105, 104.28.195.106, 104.28.227.105, 104.28.227.106, 104.28.244.114, 104.28.244.116, 163.61.198.15 and 38.54.6.28. A third party also reported 37.1.209.19 and 217.119.139.50. Look for logid="0100032001" with method="sso", followed by logid="0100044547" "Add system.admin" events that create a super_admin account named audit, backup, itadmin, secadmin, support, backupadmin, deploy, remoteadmin, security, svcadmin, system or adccount. Fortinet notes the names changed during its analysis, so review every admin account rather than matching names only.

Timeline#

  • — Fortinet publishes its SSO abuse analysis and locks out two malicious FortiCloud accounts.
  • — Fortinet disables FortiCloud SSO service-wide.
  • — FG-IR-26-060 is published. SSO is restored but refuses logins from vulnerable versions. CISA adds the CVE to KEV.
  • — Fortinet adds the last fixed releases to the advisory. This is also CISA's federal deadline.

Vulnerability records

  • CVE-2026-24858 · KEV 2026-01-27 · An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Fortinet PSIRT — FG-IR-26-060: Administrative FortiCloud SSO authentication bypass fortiguard.fortinet.com
  2. Fortinet PSIRT blog — Analysis of Single Sign-On Abuse on FortiOS fortinet.com
  3. NVD — CVE-2026-24858 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2026-24858 cisa.gov
  5. Fortinet PSIRT — FG-IR-25-647 (the December 2025 SSO bypass) fortiguard.fortinet.com