Fortinet 2026 Breach: Authentication Bypass via FortiCloud SSO Drives Widespread Exploitation
In January 2026, Fortinet suffered a critical security incident when attackers exploited CVE-2026-24858, an authentication bypass vulnerability impacting FortiCloud SSO on key products like FortiOS, FortiManager, FortiWeb, FortiProxy, and FortiAnalyzer. Malicious actors with valid FortiCloud accounts could access devices registered to other users, enabling unauthorized firewall changes, new privileged account creation, and illicit VPN reconfiguration, even on systems patched for earlier SSO flaws. Fortinet responded by temporarily disabling and then remediating FortiCloud SSO, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. This incident underscores the risks of centralized identity platforms and SSO misconfigurations, as well as the persistent attacker interest in cloud-managed network appliances. Growing exploitation of authentication bypass vulnerabilities has regulatory and operational implications for organizations reliant on integrated cloud services.
Kill Chain
