---
title: "FortiCloud SSO Cross-Account Login: CVE-2026-24858"
url: https://erroneo.us/security/briefs/forticloud-sso-cross-account-bypass-cve-2026-24858/
description: "A FortiCloud account plus a registered device let attackers log into other customers' Fortinet gear with FortiCloud SSO on. Exploited zero-day; upgrade."
type: security-brief
section: "Security Digest"
date_published: 2026-01-27
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-24858"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# FortiCloud SSO Cross-Account Login: CVE-2026-24858

**Verdict: Act now.** Any Fortinet device that relies on FortiCloud SSO needs the January 2026 builds (FortiCloud now refuses SSO from vulnerable versions anyway), and any device with SSO enabled before then should be checked for rogue admins.

- **Who must act:** Owners of FortiGate, FortiProxy, FortiManager, FortiAnalyzer, FortiWeb, FortiNAC-F or FortiSwitchManager appliances that had FortiCloud SSO admin login enabled, which GUI registration to FortiCare turns on by default.
- **Who can relax:** FortiManager Cloud, FortiAnalyzer Cloud and FortiGate Cloud are not affected, and neither are setups that use a custom SAML IdP or FortiAuthenticator instead of FortiCloud SSO.
- **Affected:** FortiOS 7.6.0-7.6.5, 7.4.0-7.4.10, 7.2.0-7.2.12, 7.0.0-7.0.18; FortiProxy 7.6.0-7.6.4, 7.4.0-7.4.12, 7.2.0-7.2.15, 7.0.0-7.0.22; FortiManager and FortiAnalyzer 7.6.0-7.6.5, 7.4.0-7.4.9, 7.2.0-7.2.11, 7.0.0-7.0.15; FortiWeb 8.0.0-8.0.3, 7.6.0-7.6.6, 7.4.0-7.4.11; FortiNAC-F 7.6.3-7.6.5; FortiSwitchManager 7.2.0-7.2.8, 7.0.0-7.0.7
- **Fixed:** FortiOS 7.6.6, 7.4.11, 7.2.13, 7.0.19; FortiProxy 7.6.5, 7.4.13, 7.2.16, 7.0.23; FortiManager / FortiAnalyzer 7.6.6, 7.4.10, 7.2.12, 7.0.16; FortiWeb 8.0.4, 7.6.7, 7.4.12; FortiNAC-F 7.6.6; FortiSwitchManager 7.2.9, 7.0.8
- **CVEs:** CVE-2026-24858
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade every affected Fortinet appliance to the FG-IR-26-060 fixed build for its train; FortiCloud SSO will not work from vulnerable versions.
2. Audit admin accounts on every device for unexpected local admins (for example audit, backup, itadmin, secadmin, support, svcadmin).
3. Search logs for SSO logins by the attacker accounts and IPs that Fortinet published.
4. If you find indicators, restore a known-clean config, then rotate admin, VPN and LDAP/AD credentials stored on the device.
5. Restrict administrative access to trusted networks with a local-in policy, and consider leaving FortiCloud SSO disabled if you don't need it.

### How to check if you are affected

- Look for logid 0100032001 SSO admin logins from cloud-noc@mail.io, cloud-init@mail.io, heltaylor.12@tutamail.com or support@openmail.pro.
- Look for logid 0100044547 'Add system.admin' events creating a super_admin account right after an SSO login.
- Check for logins or traffic from the IPs in FG-IR-26-060, such as 104.28.244.115, 104.28.212.114, 163.61.198.15 and 38.54.6.28.
- Check for configuration file downloads by SSO users.

## What happened

In January 2026, Fortinet customers began reporting unexpected admin logins that looked like the FortiCloud SSO bypass patched a month earlier ([CVE-2025-59718/59719](https://fortiguard.fortinet.com/psirt/FG-IR-25-647)). Some of the affected devices were fully upgraded. In a [PSIRT blog post dated January 22](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios), Fortinet said this pointed to a new attack path. On January 27, it published [FG-IR-26-060](https://fortiguard.fortinet.com/psirt/FG-IR-26-060) for CVE-2026-24858, an authentication bypass using an alternate path (CWE-288).

The flaw let an attacker who held a FortiCloud account and a registered device log into devices registered to *other* accounts, provided those devices had FortiCloud SSO enabled. Fortinet says two malicious FortiCloud accounts were exploiting it in the wild. It locked those accounts out on January 22, switched FortiCloud SSO off globally on January 26, and turned it back on January 27 with logins from vulnerable versions refused. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858) the same day, with a January 30 deadline. Fortinet and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-24858) list CVSS 3.1 9.8.

## Who is affected

The flaw reaches further than the December bug. It covers FortiOS 7.0-7.6, FortiProxy 7.0-7.6, FortiManager and FortiAnalyzer 7.0-7.6, FortiWeb 7.4-8.0, FortiNAC-F 7.6.3-7.6.5 and FortiSwitchManager 7.0/7.2. FortiOS 8.0 and FortiManager 8.0 are listed as not affected. As before, FortiCloud SSO is off in factory settings but is switched on when a device is registered to FortiCare from the GUI, unless the admin turns off the toggle. FortiManager Cloud, FortiAnalyzer Cloud and FortiGate Cloud are not affected. Setups that use a custom SAML IdP, including FortiAuthenticator, are also not affected. Fortinet confirmed that point on January 28 after first warning that the issue applied to all SAML SSO implementations.

## Do you really need to act?

Yes, if you use or ever enabled FortiCloud SSO. This was a zero-day that defeated a recent patch, needed nothing from the victim, and gave attackers super_admin access. Fortinet describes the attacker's main operations as downloading the customer's config file and adding an admin account for persistence. Its server-side change limits the risk of new exploitation of unpatched devices, because FortiCloud SSO no longer accepts logins from vulnerable versions. That does nothing about access the attacker already set up. A local admin account created in January still works today.

Devices that never had FortiCloud SSO enabled, or that use a third-party IdP or FortiAuthenticator, were not exposed. They still belong on your normal patch schedule.

## What to do now

1. Upgrade to the fixed builds: FortiOS 7.6.6, 7.4.11, 7.2.13 or 7.0.19, FortiProxy 7.6.5, 7.4.13, 7.2.16 or 7.0.23, FortiManager/FortiAnalyzer 7.6.6, 7.4.10, 7.2.12 or 7.0.16, FortiWeb 8.0.4, 7.6.7 or 7.4.12, FortiNAC-F 7.6.6, and FortiSwitchManager 7.2.9 or 7.0.8.
2. If you don't need FortiCloud SSO, disable it. On FortiOS and FortiProxy run `config system global`, `set admin-forticloud-sso-login disable`, `end`. On FortiManager and FortiAnalyzer run `config system saml`, `set forticloud-sso disable`, `end`.
3. Run `show system admin` and remove any account you cannot explain.
4. Apply a local-in policy so only management subnets can reach HTTPS admin.
5. If you find indicators, follow Fortinet's post-exploitation steps. Restore a known-clean configuration, audit VPN users and settings, and rotate every credential on the device, including LDAP/AD accounts.

## How to tell if you were hit

Fortinet's indicators are the SSO users `cloud-noc@mail.io`, `cloud-init@mail.io`, `heltaylor.12@tutamail.com` and `support@openmail.pro`, and the login IPs 104.28.244.115, 104.28.212.114, 104.28.212.115, 104.28.195.105, 104.28.195.106, 104.28.227.105, 104.28.227.106, 104.28.244.114, 104.28.244.116, 163.61.198.15 and 38.54.6.28. A third party also reported 37.1.209.19 and 217.119.139.50. Look for `logid="0100032001"` with `method="sso"`, followed by `logid="0100044547"` "Add system.admin" events that create a `super_admin` account named audit, backup, itadmin, secadmin, support, backupadmin, deploy, remoteadmin, security, svcadmin, system or adccount. Fortinet notes the names changed during its analysis, so review every admin account rather than matching names only.

## Timeline

- Jan 22, 2026 — Fortinet publishes its SSO abuse analysis and locks out two malicious FortiCloud accounts.
- Jan 26, 2026 — Fortinet disables FortiCloud SSO service-wide.
- Jan 27, 2026 — FG-IR-26-060 is published. SSO is restored but refuses logins from vulnerable versions. CISA adds the CVE to KEV.
- Jan 30, 2026 — Fortinet adds the last fixed releases to the advisory. This is also CISA's federal deadline.

## Sources

1. [Fortinet PSIRT — FG-IR-26-060: Administrative FortiCloud SSO authentication bypass](https://fortiguard.fortinet.com/psirt/FG-IR-26-060)
2. [Fortinet PSIRT blog — Analysis of Single Sign-On Abuse on FortiOS](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios)
3. [NVD — CVE-2026-24858](https://nvd.nist.gov/vuln/detail/CVE-2026-24858)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-24858](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858)
5. [Fortinet PSIRT — FG-IR-25-647 (the December 2025 SSO bypass)](https://fortiguard.fortinet.com/psirt/FG-IR-25-647)

---
Source page: https://erroneo.us/security/briefs/forticloud-sso-cross-account-bypass-cve-2026-24858/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt