Search/CVE-2026-24858
● CVE — Critical

CVE-2026-24858

Vendorfortinet, siemensProductfortios, fortiweb, fortianalyzer, fortimanager, fortiproxy, fortinac-f, ruggedcom ape1808 firmwareDiscoveredJan 27, 2026UpdatedJun 9, 2026

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a…

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
86.6%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
6
sources referencing this CVE
Related IOCs
5
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 26, 2026
▲ 0.75pp
85.8% → 86.6% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
15 relationships
Timeline
disclosure → media coverage
Jan 27, 2026
Disclosure — published as a CVE record. · last revised by NVD Jun 9, 2026
Jan 27, 2026
bleepingcomputer.com reports: Fortinet blocks exploited FortiCloud SSO zero day until patch is ready
Jan 28, 2026
helpnetsecurity.com reports: Fortinet starts patching exploited FortiCloud SSO zero-day (CVE-2026-24858)
Jan 28, 2026
thehackernews.com reports: Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected
Jan 28, 2026
redhotcyber.com reports: Vulnerabilità Fortinet CVE-2026-24858: Hacker Dentro le Reti con Credenziali Legittime
Jan 28, 2026
securityweek.com reports: Fortinet Patches Exploited FortiCloud SSO Authentication Bypass
Mar 4, 2026
atmarkit.itmedia.co.jp reports: VPN設定の不正変更も　CISA、Fortinet製品の認証バイパス脆弱性に関するガイダンスを公開
Public PoC (5)
github.com/m0d0ri205/CVE-2026-24858github.com/absholi7ly/CVE-2026-24858-FortiCloud-SSO-Authentication-Bypassgithub.com/SimoesCTT/-CTT-NSP-Convergent-Time-Theory---Network-Stack-Projection-CVE-2026-24858-github.com/SimoesCTT/SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularitygithub.com/gagaltotal/cve-2026-24858
Unverified third-party code — review before executing.