This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Fortinet fixes an actively exploited vulnerability

Fortinet fixes a critical, actively exploited vulnerability in various products [1][2]. Products and their fixed versions: FortiAnalyzer - 7.6.6, 7.4.10, 7.2.12, 7.0.16 FortiManager - 7.6.6, 7.4.10, 7.2.13, 7.0.16 FortiOS - 7.6.6, 7.4.11, 7.2.13, 7.0.19 FortiProxy - 7.6.6, 7.4.13 FortiWeb - 8.0.4, 7.6.7, 7.4.12

FortiAnalyzer, FortiManager, FortiOS, FortiProxy, FortiWeb - authentication bypass (CVE-2026-24858)
CVSS 9.8 (Critical)

A remote attacker authenticated in FortiCloud SSO with a registered device can bypass authentication and log in to the administration of other devices (FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb) registered under other FortiCloud accounts, if administrative login using FortiCloud SSO is enabled on the target devices. The FortiCloud SSO login feature is not enabled by default, but it is enabled automatically when the device is registered to FortiCare in the GUI, unless the administrator turns off the option "Allow administrative login using FortiCloud SSO" [1].

The vulnerability is present in products:

  • FortiAnalyzer; >=7.6.0, <=7.6.5; >=7.4.0, <=7.4.9; >=7.2.0, <=7.2.11; >=7.0.0, <=7.0.15
  • FortiManager; >=7.6.0, <=7.6.5; >=7.4.0, <=7.4.9; >=7.2.0, <=7.2.11; >=7.0.0, <=7.0.15
  • FortiOS; >=7.6.0, <=7.6.5; >=7.4.0, <=7.4.10; >=7.2.0, <=7.2.12; >=7.0.0, <=7.0.18
  • FortiProxy; >=7.6.0, <=7.6.4; >=7.4.0, <=7.4.12; =7.2; =7.0
  • FortiWeb; >=8.0.0, <=8.0.3; >=7.6.0, <=7.6.6; >=7.4.0, <=7.4.11

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 27. 1. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 29. 1. 2026.

CESNET, z.s.p.o. Logo