Incident · Resolved
FortiCloud SSO Authentication Bypass
Fortinet FortiOS (FortiCloud SSO) · 2 stories since JAN 22
- 2
- stories
- 3
- CVEs
- JAN 28
- latest
The story so far
In January 2026, attackers began making unauthorized configuration changes to Fortinet FortiGate devices, including some that were fully patched. Fortinet traced it to CVE-2026-24858, a critical flaw that let someone with a FortiCloud account log in to other customers’ devices that had FortiCloud single sign-on turned on. Fortinet locked the two malicious accounts, briefly switched off FortiCloud SSO and released fixes.
Written by the editors