Over 3.28 Million Fortinet Devices Exposed via FortiCloud SSO Authentication Bypass

CVE-2026-24858 Authentication Bypass Active Exploitation

Overview

More than 3.28 million internet-exposed Fortinet devices were found vulnerable due to a critical authentication bypass flaw in FortiCloud Single Sign-On (SSO). When FortiCloud SSO is enabled, attackers with valid FortiCloud credentials can log into other organizations' Fortinet devices without authorization, leading to full administrative access. Active exploitation has been confirmed in the wild, with attackers gaining unauthorized access to security appliances, exposing firewall rules, VPN credentials, and enabling lateral movement into internal enterprise networks.

Technical Specifications

Attribute	Details
CVE ID	CVE-2026-24858
Vulnerability Type	Authentication Bypass via SSO Trust Validation Flaw
CVSS Score	9.8 (Critical)
Attack Vector	Network
Authentication	Low (valid FortiCloud account required)
Complexity	Low
User Interaction	Not Required
Affected Feature	FortiCloud Single Sign-On (SSO)

Affected Products

• FortiOS (FortiGate firewalls)
• FortiManager
• FortiAnalyzer
• FortiProxy
• FortiWeb
• Status: Active exploitation / Patches available (FortiOS 7.4.11, 7.6.6+)
• 3.28+ million internet-exposed devices at risk

Technical Details

Root Cause

Improper trust validation between FortiCloud SSO and registered devices allows authentication bypass when:

• Target device has FortiCloud SSO enabled
• Attacker possesses valid FortiCloud credentials (even from different organization)
• Device is accessible from the internet

Attack Requirements

1. Valid FortiCloud account (attacker-controlled or compromised)
2. Target device registered with FortiCloud SSO enabled
3. Network access to the management interface

Exploit Result

• Complete authentication bypass
• Full administrative access to the device
• Ability to download configurations and create persistent accounts

Attack Scenario

1. Attacker obtains or creates a valid FortiCloud account
2. Scans for and identifies internet-exposed Fortinet devices with FortiCloud SSO enabled
3. Exploits CVE-2026-24858 to bypass authentication using their FortiCloud credentials
4. Gains full administrative access to the target device
5. Downloads configuration files containing firewall rules, VPN credentials, and network topology
6. Creates persistent rogue admin accounts for long-term access
7. Uses the compromised security appliance to pivot into internal enterprise networks

Impact Assessment

ConfidentialityIntegrityAvailability

• Exposure of firewall rules and security policies
• Theft of VPN credentials and authentication tokens
• Access to network topology and infrastructure details
• Exposure of configuration backups and sensitive settings

• Creation of persistent backdoor admin accounts
• Modification of firewall rules and security policies
• Tampering with logging and monitoring configurations
• Potential manipulation of VPN and routing configurations

• Potential disruption of security services
• Risk of firewall rule modifications blocking legitimate traffic
• Lateral movement enabling broader infrastructure compromise
• High risk to critical infrastructure and government environments

Mitigation Strategies

Immediate Actions

• Immediately patch to fixed versions (FortiOS 7.4.11, 7.6.6, and later for all affected products)
• Disable FortiCloud SSO on all internet-facing devices until fully patched
• Audit local admin accounts for suspicious or unknown users
• Review recent authentication logs for unauthorized FortiCloud SSO logins
• Isolate potentially compromised devices for forensic analysis

Short-term Measures

• Restrict management interfaces from public internet access using access control lists
• Implement multi-factor authentication for all administrative access
• Rotate all credentials and API tokens on affected devices
• Review and validate all firewall rules and VPN configurations
• Disable unnecessary remote management features

Monitoring & Detection

• Monitor logs for abnormal FortiCloud authentication activity
• Alert on new admin account creations
• Track configuration changes and downloads
• Watch for unusual VPN connection patterns
• Monitor for lateral movement indicators from compromised devices
• Review access logs for unexpected IP addresses or geographic locations

Long-term Solutions

• Implement zero-trust architecture for infrastructure management
• Use dedicated management networks isolated from the internet
• Deploy jump hosts or bastion servers for administrative access
• Establish continuous vulnerability monitoring for Fortinet products
• Implement network segmentation to limit blast radius of compromises
• Maintain comprehensive logging and SIEM integration
• Conduct regular security audits of Fortinet device configurations
• Establish incident response playbooks for security appliance compromises

Resources and References

Official Documentation

• 3,280,081 Fortinet Devices Online With Exposed Web Properties Under Risk
• CVE-2026-24858: Critical FortiCloud SSO Zero-day Under Active Exploitation | Hive Pro
• 3.28 Million Fortinet Devices at Risk Due to Exposed Web Properties
• Over 3.28 Million Fortinet Devices Exposed Online With Risky Web Properties
• Fortinet Confirms Critical FortiCloud SSO Vulnerability(CVE-2026-24858) Actively Exploited in the Wild

---

Last Updated: February 3, 2026