Fortinet assigns new CVE after SSO bypass hits fully patched FortiGate devices

Fortinet on Jan. 27, 2026, assigned a new identifier, CVE-2026-24858, to an authentication bypass that attackers had used against FortiGate firewalls and other Fortinet products, including devices that were fully patched against a similar flaw disclosed in December. CISA added the bug to its Known Exploited Vulnerabilities catalogue the same day, and the Canadian Centre for Cyber Security updated its alert AL25-019.

The episode matters because many organizations had already treated the December issue as closed. Firewalls, management consoles and proxies from Fortinet are common in Canadian government, health and business networks.

How it unfolded

On Dec. 9, 2025, Fortinet disclosed CVE-2025-59718 and CVE-2025-59719, two flaws rated 9.8 that let an unauthenticated attacker bypass FortiCloud single sign-on (SSO) login with a crafted SAML message. The Cyber Centre published AL25-019 on Dec. 15, and CISA listed CVE-2025-59718 as exploited on Dec. 16.

On Jan. 22, Fortinet posted an emergency blog saying some customers who had installed the December fix were seeing unexpected logins that looked like the earlier attacks. The Cyber Centre noted that, while exploitation had involved FortiCloud SSO, the underlying issue applied to all SAML SSO implementations in Fortinet products.

Fortinet's advisory FG-IR-26-060 describes CVE-2026-24858 as an authentication bypass using an alternate path or channel, rated 9.8. It affects FortiOS, FortiManager, FortiAnalyzer, FortiProxy and FortiNAC-F, among others.

For defenders, the lesson was uncomfortable: installing the December patch did not close every path. Organizations that had disabled FortiCloud SSO or kept admin interfaces off the internet were far less exposed than those relying on the update alone.

Affected versions

According to the Cyber Centre's update, affected releases include FortiOS 7.6.0 to 7.6.5, 7.4.0 to 7.4.10, 7.2.0 to 7.2.12 and 7.0.0 to 7.0.18, along with matching FortiManager, FortiAnalyzer and FortiProxy branches. FortiProxy 7.2 and 7.0 have no fix and must be migrated. Several fixed builds were listed as "upcoming" when the update was published.

What to do

• Install the fixed release for each product as it becomes available, for example FortiOS 7.4.11, and track Fortinet's PSIRT page for the remaining builds.
• Disable FortiCloud SSO on any device that does not need it.
• Block administrative access from the internet; use out-of-band management or a local-in policy to restrict which addresses can reach the admin interface.
• Check logs and configurations against the indicators of compromise in Fortinet's blog post.