Fortinet starts patching exploited FortiCloud SSO zero-day (CVE-2026-24858)

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Fortinet has begun releasing security updates to address a critical flaw impacting FortiOS that has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2026-24858 (CVSS score: 9.4), has been described as an authentication bypass related to FortiOS single sign-on (SSO). The flaw also affects FortiManager and FortiAnalyzer. The company said it's continuing to investigate if other products, including FortiWeb and FortiSwitch Manager, are impacted by the flaw. "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS, FortiManager, FortiAnalyzer may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices," Fortinet said in an advisory released Tuesday. It's worth noting that the FortiCloud SSO login feature is not enabled in the default factory settings. It's only turned on in scenarios where an administrator registers the device to FortiCare from the device's GUI, unless they have taken steps to explicitly toggle the "Allow administrative login using FortiCloud SSO" switch. The development comes days after Fortinet confirmed that unidentified threat actors were abusing a "new attack path" to achieve SSO logins without requiring any authentication. The access was abused to create local admin accounts for persistence, make configuration changes granting VPN access to those accounts, and exfiltrate those firewall configurations. Over the past week, the network security vendor said it has taken the following steps - Locked out two malicious FortiCloud accounts ([email protected] and [email protected]) on January 22, 2026 Disabled FortiCloud SSO on the FortiCloud side on January 26, 2026 Re-enabled FortiCloud SSO on January 27, 2026, while disabling the option to login from devices running vulnerable versions In other words, customers are required to upgrade to the latest versions of the software for the FortiCloud SSO authentication to function. Fortinet is also urging users who detect signs of compromise to treat their devices as breached and recommends the following actions - Ensure the device is running the latest firmware version Restore configuration with a known clean version or audit for any unauthorized changes Rotate credentials, including any LDAP/AD accounts that may be connected to the FortiGate devices The development has led the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add CVE-2026-24858 to its Known Exploited Vulnerabilities (KEV) catalog, mandating Federal Civilian Executive Branch (FCEB) agencies to remediate the issues by January 30, 2026. Update On January 28, 2026, CISA issued additional guidance for CVE-2026-24858, noting that it allows "malicious actors with a FortiCloud account and a registered device to log in to separate devices registered to other users in FortiOS, FortiManager, FortiWeb, FortiProxy, and FortiAnalyzer, if FortiCloud single sign-on (SSO) is enabled on devices." Customers of FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb are all affected and should upgrade to the latest version to restore FortiCloud SSO services. Fortinet is still investigating FortiSwitch Manager for its exposure to the security flaw. The company has since confirmed that the issue only impacts FortiCloud SSO and does not affect third-party SAML IdP or FortiAuthenticator implementations. The agency is also urging users to "check for indicators of compromise on all internet-accessible Fortinet products affected by this vulnerability and immediately apply updates as soon as they are available using Fortinet's instructions."

Fortinet starts patching exploited FortiCloud SSO zero-day (CVE-2026-24858) Fortinet has begun releasing FortiOS versions that fix CVE-2026-24858, a critical zero-day vulnerability that allowed attackers to log into targeted organizations’ FortiGate firewalls. “This vulnerability was found being exploited in the wild by two malicious FortiCloud accounts, which were locked out on [January 22, 2026],” the company shared. About CVE-2026-24858 On January 20, several Fortinet customers revealed that attackers gained access to their FortiGate firewalls and created new local admin accounts despite the devices running the then-latest FortiOS versions. Those releases included patches for CVE-2025-59718, a previously exploited vulnerability that similarly allowed attackers to bypass authentication on vulnerable, internet-accessible devices. Affected users speculated that CVE-2025-59718 hadn’t been adequately fixed, but Fortinet now says that the attackers leveraged a separate security vulnerability: CVE-2026-24858. CVE-2026-24858 is an “authentication bypass using an alternate path or channel” vulnerability that may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts (if FortiCloud SSO authentication is enabled on those devices). The vulnerability affects FortiOS, the proprietary OS running on Fortinet’s firewalls, as well as FortiAnalyzer, the company’s logging, analytics, and reporting platform, and FortiManager, its platform for managing Fortinet security devices. Like CVE-2025-59718 before it, CVE-2026-24858 is only exploitable on devices that have the FortiCloud SSO login feature enabled. What to do? CVE-2026-24858 has been fixed in FortiOS 7.4.11 and other FortiOS, FortiManager and FortiAnalyzer versions are to be released shortly. Fortinet advises customers to upgrade when these fixed versions become available and not to bother with disabling FortiCloud SSO login on the client side. “To protect its customers from further exploit, Fortinet disabled FortiCloud SSO on FortiCloud side on [January 26, 2026]. It was re-enabled on [January 27, 2026] and no longer supports login from devices running vulnerable versions. Consequently, customers must upgrade to the latest versions (…) for the FortiCloud SSO authentication to function,” the company explained. Fortinet has also expanded the initial list of IP addresses and account names used in these latest attacks. Fortinet’s advice to customers continues to include security best practices, such as restricting administrative access to edge network devices over the internet or limiting, via local-in policies, the IP addresses allowed to access the administrative interface. Organizations that have not done so should check their logs for known indicators of compromise and suspicious admin accounts. If any are found, they should rotate credentials and restore the device configuration from a known clean version. UPDATE (January 29, 2026, 06:35 a.m. ET): Fortinet has patched CVE-2026-24858 in FortiOS v7.6.6 and updated the associated security advisory to say that: FortiManager Cloud, FortiAnalyzer Cloud, FortiGate Cloud are not impacted by this issue Setups with custom identity providers (IdP) for single sign-on (i.e., third-party SAML SSO) instead of FortiCloud are not impacted. This includes setups using FortiAuthenticator as the custom IdP. Additional changes to the document show that CVE-2026-24858 also affects FortyProxy (secure web gateway / proxy server) and the FortiWeb web application firewall. According to Shadowserver, there are currently less than 10,000 exposed Fortinet instances with FortiCloud SSO enabled, down from 26,000+ in late December 2025. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!