CISA Warns of FortiCloud SSO Authentication Bypass Flaw Actively Exploited by Hackers

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding a severe authentication bypass vulnerability affecting multiple Fortinet products.

The flaw, tracked as CVE-2026-24858, allows attackers with a FortiCloud account to gain unauthorized access to security appliances registered under other customer accounts when FortiCloud Single Sign-On (SSO) authentication is enabled.

Vulnerability

Sponsored

Details

The vulnerability impacts Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy, representing a significant threat to enterprise security infrastructure.

Classified under CWE-288 (Use of Incorrect Type of Authentication), the flaw exploits an alternate path or channel in the authentication mechanism.

An attacker requires two prerequisites: a valid FortiCloud account and a registered device. With these credentials, the attacker can bypass authentication controls and log into security appliances belonging to other customer accounts.

The vulnerability is particularly dangerous because FortiCloud SSO is a widely deployed authentication mechanism across enterprise environments.

Organizations that have enabled SSO functionality on their Fortinet devices are directly exposed to this threat vector.

The authentication bypass creates a direct pathway for lateral movement within security infrastructure, potentially compromising network access controls and enabling further attacks deeper into network environments.

This authentication bypass represents a critical escalation vector for threat actors. Rather than targeting individual user credentials or exploiting application-level vulnerabilities, attackers can leverage compromised or newly created FortiCloud accounts to penetrate security appliances that serve as network perimeter defenses.

The requirement for only a FortiCloud account and a registered device, both relatively easy to obtain or create, significantly lowers the barrier to exploitation.

Security researchers have confirmed that the vulnerability is actively exploited in real-world attack scenarios.

The fact that active exploitation has been documented indicates that threat actors have already incorporated this technique into their attack toolkits.

Organizations operating affected Fortinet products should assume this vulnerability has been discovered by adversaries and prioritize immediate remediation efforts.

CISA recommends organizations take immediate action to mitigate exposure. The primary recommendations include:

Immediate mitigation involves applying vendor-supplied patches and security updates from Fortinet. Organizations should consult Fortinet’s security advisory (FG-IR-26-060) and review the technical analysis provided on the Fortinet PSIRT blog for specific patching guidance tailored to their deployments.

For organizations unable to apply patches immediately, alternative mitigations should be implemented.

These include disabling FortiCloud SSO authentication on exposed devices if operationally feasible, implementing network segmentation to restrict access to management interfaces, and enforcing additional authentication controls at the network perimeter.

Following BOD 22-01 guidance for cloud services is mandatory for federal agencies and strongly recommended for critical infrastructure operators.

This executive order establishes baseline security requirements for federal cloud service usage. Organizations should conduct a comprehensive risk assessment of their FortiCloud deployments and determine compliance status.

Organizations with no available mitigations or patches should evaluate discontinuing use of affected products in high-risk environments.

While this represents a significant operational disruption, maintaining use of unpatched security appliances with known authentication bypasses introduces unacceptable risk.

The vulnerability highlights the importance of maintaining a vigilant security posture for cloud-based authentication mechanisms.

FortiCloud SSO, while offering operational convenience, introduces cloud dependency into enterprise security infrastructure.

This centralized authentication point, if compromised, can lead to cascading failures across multiple security appliances.

The CVE-2026-24858 authentication bypass represents an urgent threat requiring immediate attention from organizations operating Fortinet security appliances with FortiCloud SSO enabled.

Threat actors are actively exploiting this vulnerability, making rapid remediation imperative. Organizations must prioritize patch deployment, implement compensating controls, and evaluate their overall FortiCloud dependency strategy to prevent unauthorized access to critical security infrastructure.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post CISA Warns of FortiCloud SSO Authentication Bypass Flaw Actively Exploited by Hackers appeared first on Cyber Security News.