CVE-2026-24858

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
Fortinet	FortiWeb	>= 8.0.0, <= 8.0.3; >= 7.6.0, <= 7.6.6; >= 7.4.0, <= 7.4.11
Fortinet	FortiNAC-F	>= 7.6.3, <= 7.6.5
Fortinet	FortiOS	>= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.10; >= 7.2.0, <= 7.2.12; >= 7.0.0, <= 7.0.18
Fortinet	FortiAnalyzer	>= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.9; >= 7.2.0, <= 7.2.11; >= 7.0.0, <= 7.0.15
Fortinet	FortiProxy	>= 7.6.0, <= 7.6.4; >= 7.4.0, <= 7.4.12; >= 7.2.0, <= 7.2.15; >= 7.0.0, <= 7.0.22
Fortinet	FortiManager	>= 7.6.0, <= 7.6.5; >= 7.4.0, <= 7.4.9; >= 7.2.0, <= 7.2.11; >= 7.0.0, <= 7.0.15
Siemens	RUGGEDCOM APE1808	< *

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-060Vendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-975644.htmlThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858US Government Resource
https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortiosMitigation, Vendor Advisory

Timeline

Published: Jan 27, 2026
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 27, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-24866.4The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' paramete CVE-2026-248686.5Mitigation bypass in the Privacy: Anti-Tracking component. This vulnerability was fixed in Firefox 147.0.2.CVE-2026-248698.8Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 147.0.2.CVE-2026-24874.4The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and inclu CVE-2026-248707.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: b CVE-2026-2487110.0Improper Control of Generation of Code ('Code Injection') vulnerability in pilgrimage233 Minecraft-Rcon-Manage.This issue affects Minecraft-CVE-2026-248729.8improper pointer arithmetic vulnerability in ProjectSkyfire SkyFire_548.This issue affects SkyFire_548: before 5.4.8-stable5.CVE-2026-248737.8Out-of-bounds Read vulnerability in Rinnegatamante lpp-vita.This issue affects lpp-vita: before lpp-vita r6.CVE-2026-248749.1Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in themrdemonized xray-monolith.This issue affects xray-monolith CVE-2026-248757.8Integer Overflow or Wraparound vulnerability in yoyofr modizer.This issue affects modizer: before 4.1.1.CVE-2026-24884.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized message deletion due to a missing CVE-2026-248807.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension.