CVE-2026-24858

The vulnerability in Fortinet's products stems from an authentication bypass issue that allows an attacker with a FortiCloud account and a registered device to gain unauthorized access to other devices registered under different accounts. This flaw is particularly concerning because it exploits the Single Sign-On (SSO) feature enabled on FortiAnalyzer, FortiManager, FortiOS, FortiProxy, and FortiWeb systems. The underlying issue arises from improper validation of authentication tokens, which can be manipulated to bypass security controls. As a result, an attacker can potentially access sensitive data and administrative functionalities of devices they should not have access to, leading to significant security breaches.

Attack vectors for this vulnerability are varied and can be executed with relative ease by malicious actors. An attacker could leverage their own FortiCloud account to authenticate against any of the affected devices, provided that SSO authentication is enabled. This means that an attacker does not need to compromise the target device directly; instead, they can exploit the trust relationship established through the SSO mechanism. Scenarios could include accessing sensitive logs, altering configurations, or even deploying malicious updates, all of which could have devastating consequences for the integrity and confidentiality of the network infrastructure.

The real-world impact of this vulnerability is profound, particularly for organizations relying on Fortinet's products for network security and management. Given the critical nature of the affected systems, a successful exploitation could lead to unauthorized access to sensitive information, disruption of services, and potential data breaches. The business risks are substantial, including financial losses, reputational damage, and regulatory penalties, especially if sensitive customer data is compromised. Organizations may face increased scrutiny from stakeholders and regulatory bodies, potentially leading to long-term consequences that extend beyond immediate financial impacts.

To detect and mitigate this vulnerability, organizations should prioritize immediate updates to the latest versions of the affected Fortinet products, as these updates include patches designed to close the authentication bypass loophole. Additionally, implementing strict access controls and monitoring for unusual login attempts can help detect potential exploitation attempts. Regular audits of account permissions and SSO configurations are also advisable to ensure that only authorized devices and users have access to critical systems. Furthermore, organizations should consider employing multi-factor authentication (MFA) to add an additional layer of security, making it more difficult for attackers to gain unauthorized access, even if they possess valid credentials.

In conclusion, the authentication bypass vulnerability in Fortinet's products represents a significant threat to the security posture of organizations utilizing these systems. The ease of exploitation and the potential for severe consequences necessitate immediate attention from cybersecurity teams. By understanding the technical aspects of the vulnerability, recognizing the potential attack vectors, assessing the real-world impact, and implementing robust detection and mitigation strategies, organizations can better protect themselves against this and similar threats in the future.

Recent telemetry from CSURFACE threat intelligence indicates a marked reduction in detection activity related to CVE-2026-24858, despite a significant increase in the Exploit Prediction Scoring System (EPSS) value, which more than doubled. This divergence suggests that while active exploitation attempts observed by our sensors have declined, the vulnerability remains highly attractive to adversaries, as evidenced by the rising EPSS and the continued availability of multiple proof-of-concept exploits in public repositories. The slight downward adjustment of the CVSS score from 9.8 to 9.4 reflects refined understanding of the vulnerability’s impact but does not diminish its critical severity. Importantly, ransomware groups previously associated with Fortinet product exploits have not demonstrated high-confidence use of this vulnerability, though the persistence of publicly accessible exploit code maintains a latent risk for opportunistic attackers. For defenders, this evolving landscape underscores the need for vigilant monitoring, as the gap between observed exploitation and exploitability may indicate emerging attack techniques or shifts in adversary focus. Consequently, the overall threat level remains critical, with potential for rapid escalation should exploitation activity intensify.

Update 2 — June 15, 2026

CSURFACE threat intelligence has identified a significant increase in the Exploit Prediction Scoring System (EPSS) for CVE-2026-24858, rising sharply to place this vulnerability in the 0.99th percentile of exploitability. This surge is accompanied by a marked decrease in detection activity across our sensors, suggesting adversaries may be refining their tactics or leveraging stealthier methods to exploit the authentication bypass flaw in Fortinet FortiOS and related products. Concurrently, new proof-of-concept exploits have emerged publicly, highlighting ongoing research and potential weaponization efforts targeting the FortiCloud Single Sign-On mechanism. Although ransomware groups previously linked to Fortinet exploits have not yet demonstrated high-confidence use of this vulnerability, the rapid increase in EPSS and the availability of exploit code elevate the latent risk of opportunistic attacks. This dynamic shift underscores a heightened threat environment where the gap between observed exploitation and exploitability metrics signals potential for imminent escalation. Consequently, the overall risk level for organizations using affected Fortinet products should be considered critically elevated, warranting intensified vigilance despite the current reduction in observable attack activity.