CVE-2026-24858

This flaw lets someone sign in through a back door using FortiCloud SSO—without actually being allowed to access your specific device. Think of it like a club that lets people enter “through the front door,” but a mistake in the membership check could let the wrong members slip in through a side route. Once inside, an attacker may be able to view or change things they shouldn’t and help start a bigger compromise.

This matters if your business runs Fortinet network management/security products (FortiAnalyzer, FortiManager, FortiNAC-F, FortiProxy, FortiWeb, FortiOS, or Ruggedcom APE1808) and you have FortiCloud SSO enabled on those devices. The risk requires that the attacker has a FortiCloud account and a registered device, and that FortiCloud SSO is enabled on your target. In short: it’s primarily a risk to systems where FortiCloud SSO is turned on and reachable for the attacker’s FortiCloud flow—this is not about tricking a user into clicking something.

This is urgent because CISA KEV confirms the vulnerability is being used in real attacks, and reporting ties exploitation to the FortiBleed campaign. Since it is an authentication bypass connected to FortiCloud SSO, attackers can potentially access devices they shouldn’t, leading to account and configuration compromise. Apply the vendor mitigations and upgrade the affected systems immediately.