FortiCloud SSO Authentication Bypass in Fortinet Multiple Products
CVE-2026-24858 is a critical authentication bypass vulnerability in Fortinet products that use FortiCloud single sign-on (SSO). According to the provided content, the flaw affects FortiAnalyzer 7.6.0 through 7.6.5, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.15; FortiManager 7.6.0 through 7.6.5, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.15; FortiNAC-F 7.6.3 through 7.6.5; FortiOS 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.12, and 7.0.0 through 7.0.18; FortiProxy 7.6.0 through 7.6.4, 7.4.0 through 7.4.12, 7.2.0 through 7.2.15, and 7.0.0 through 7.0.22; and FortiWeb 8.0.0 through 8.0.3, 7.6.0 through 7.6.6, and 7.4.0 through 7.4.11. The issue is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel. The provided vendor description states that an attacker with a FortiCloud account and a registered device can log into devices registered to other accounts if FortiCloud SSO authentication is enabled on those target devices. Supporting content further indicates the weakness is tied to abuse of the FortiCloud SSO/SAML trust relationship rather than compromise of local credentials. Fortinet reported active exploitation in the wild and linked observed abuse to malicious FortiCloud accounts.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
Repository contains a small Python helper tool for CVE-2026-24858 described as an “Administrative FortiCloud SSO authentication bypass.” Structure: - cve_2026_24858_tool.py: single CLI utility with two subcommands: - scan: performs an HTTP(S) GET to the target root path “/” (default https/443), then heuristically flags Fortinet devices by checking for “Forti/FortiGate/FortiOS” in the Server header or HTML body and for headers starting with “X-Forti”. Can print headers/body snippet, dump full body, and save response to disk. - exploit: disabled by default; requires --enable-exploit. Reads a local payload file as raw bytes and POSTs it to an operator-specified endpoint on the target using Content-Type: application/octet-stream. Returns HTTP status, headers, and body snippet; can dump/save full response. - README.md: usage examples and warnings; explicitly states the tool does not craft payloads and only sends exact bytes provided. - requirements.txt: requests>=2.25.0. Overall purpose: a conservative scanner plus a generic payload delivery helper for testing a suspected vulnerable Fortinet web management endpoint. It does not implement the auth bypass logic itself; exploitation depends on the user knowing the correct vulnerable path and providing a crafted payload externally.
Repository purpose: a Python proof-of-concept exploit named “SCTT-0004 VORTEX / SCTT-2026-33-0004” claiming a Fortinet/FortiCloud SSO “temporal session collision” that can bypass mitigations for CVE-2026-24858 by repeatedly interacting with the SSO login flow using precisely timed delays across 33 “layers.” Structure: - README.md: High-level claim and usage instructions (run script with <target> and <token>; oscillate for 33 layers). - SCTT-0004-VORTEX.py: Main exploit/PoC implementation. Creates a requests.Session with TLS verification disabled, computes per-layer timing (“temporal resonance”), crafts SAML-assertion-like data structures per layer (NameID, Conditions, AuthnStatement, Fortinet identity attributes), and drives a multi-request sequence intended to cause an identity/session privilege collision. Includes an interactive authorization prompt and prints results. - SCTT-2026-33-0004.json: Metadata describing the claimed vulnerability, mapping to CWE-288/CWE-347, affected versions, and references to CVE-2026-24858 and CVE-2025-59718. - LICENSE: MIT. Exploit capabilities (as implemented/claimed): - Remote, network-based interaction with a FortiCloud/Fortinet SSO endpoint. - Timing-based request orchestration over 33 iterations to attempt authentication bypass / privilege escalation via session-table “collision.” - Post-condition check by requesting an admin resource path to infer elevated access. Notable observables: - Hardcoded relative paths: /remote/saml/login and /admin/dashboard. - SAML/Fortinet attribute URNs embedded in the crafted assertion structure. - No hardcoded C2 infrastructure; target is user-supplied. The code is more consistent with a PoC than a fully weaponized module (no robust target fingerprinting, limited error handling shown in the provided excerpt, and no configurable payload beyond the request sequence).
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
203 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
FortiGate vulnerability possibly used in the FortiBleed campaign; described in context as one of the older unpatched flaws enabling authentication bypass and takeover of devices.
Fortinet states this issue may have been used to collect credentials involved in the FortiBleed campaign, but the article provides no technical details about the flaw itself.
A FortiCloud SSO login authentication bypass vulnerability previously exploited in incidents whose stolen credentials are believed to be reused in the FortiBleed campaign.
A FortiCloud single sign-on bypass vulnerability that allows unauthorized configuration changes and account creation on vulnerable devices.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.