FortiCloud SSO Authentication Bypass in Fortinet FortiOS/FortiManager/FortiAnalyzer/FortiProxy/FortiWeb
CVE-2026-24858 is a critical authentication bypass vulnerability in Fortinet products that use FortiCloud SSO for administrative login. Affected products and versions include FortiAnalyzer 7.6.0 through 7.6.5, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.15; FortiManager 7.6.0 through 7.6.5, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.15; FortiOS 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.12, and 7.0.0 through 7.0.18; FortiProxy 7.6.0 through 7.6.4, 7.4.0 through 7.4.12, 7.2.0 through 7.2.15, and 7.0.0 through 7.0.22; and FortiWeb 8.0.0 through 8.0.3, 7.6.0 through 7.6.6, and 7.4.0 through 7.4.11. Fortinet describes the issue as Authentication Bypass Using an Alternate Path or Channel. The flaw allows an attacker who has a valid FortiCloud account and at least one registered device to authenticate to devices registered under other customers’ accounts, provided FortiCloud SSO authentication is enabled on the target device. Public reporting ties exploitation to abuse of the FortiCloud trust relationship / SSO path rather than compromise of the victim’s local credentials. Fortinet confirmed active exploitation in the wild and reported abuse by two malicious FortiCloud accounts prior to blocking them.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Repository contains a small Python helper tool for CVE-2026-24858 described as an “Administrative FortiCloud SSO authentication bypass.” Structure: - cve_2026_24858_tool.py: single CLI utility with two subcommands: - scan: performs an HTTP(S) GET to the target root path “/” (default https/443), then heuristically flags Fortinet devices by checking for “Forti/FortiGate/FortiOS” in the Server header or HTML body and for headers starting with “X-Forti”. Can print headers/body snippet, dump full body, and save response to disk. - exploit: disabled by default; requires --enable-exploit. Reads a local payload file as raw bytes and POSTs it to an operator-specified endpoint on the target using Content-Type: application/octet-stream. Returns HTTP status, headers, and body snippet; can dump/save full response. - README.md: usage examples and warnings; explicitly states the tool does not craft payloads and only sends exact bytes provided. - requirements.txt: requests>=2.25.0. Overall purpose: a conservative scanner plus a generic payload delivery helper for testing a suspected vulnerable Fortinet web management endpoint. It does not implement the auth bypass logic itself; exploitation depends on the user knowing the correct vulnerable path and providing a crafted payload externally.
Repository purpose: a Python proof-of-concept exploit named “SCTT-0004 VORTEX / SCTT-2026-33-0004” claiming a Fortinet/FortiCloud SSO “temporal session collision” that can bypass mitigations for CVE-2026-24858 by repeatedly interacting with the SSO login flow using precisely timed delays across 33 “layers.” Structure: - README.md: High-level claim and usage instructions (run script with <target> and <token>; oscillate for 33 layers). - SCTT-0004-VORTEX.py: Main exploit/PoC implementation. Creates a requests.Session with TLS verification disabled, computes per-layer timing (“temporal resonance”), crafts SAML-assertion-like data structures per layer (NameID, Conditions, AuthnStatement, Fortinet identity attributes), and drives a multi-request sequence intended to cause an identity/session privilege collision. Includes an interactive authorization prompt and prints results. - SCTT-2026-33-0004.json: Metadata describing the claimed vulnerability, mapping to CWE-288/CWE-347, affected versions, and references to CVE-2026-24858 and CVE-2025-59718. - LICENSE: MIT. Exploit capabilities (as implemented/claimed): - Remote, network-based interaction with a FortiCloud/Fortinet SSO endpoint. - Timing-based request orchestration over 33 iterations to attempt authentication bypass / privilege escalation via session-table “collision.” - Post-condition check by requesting an admin resource path to infer elevated access. Notable observables: - Hardcoded relative paths: /remote/saml/login and /admin/dashboard. - SAML/Fortinet attribute URNs embedded in the crafted assertion structure. - No hardcoded C2 infrastructure; target is user-supplied. The code is more consistent with a PoC than a fully weaponized module (no robust target fingerprinting, limited error handling shown in the provided excerpt, and no configurable payload beyond the request sequence).
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
199 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A FortiCloud single sign-on bypass vulnerability that allows unauthorized configuration changes and account creation on vulnerable devices.
A Fortinet zero-day vulnerability for which Fortinet mitigated risk by blocking FortiCloud SSO connections from devices running vulnerable firmware versions.
A Fortinet zero-day vulnerability referenced as being mitigated during active attacks by blocking FortiCloud SSO connections from vulnerable devices.
A known vulnerability in FortiGate Next-Generation Firewall appliances leveraged by attackers to gain access and extract configuration files.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.