by Kastro
Paper/Archive/CVE-2026-24858

CVE-2026-24858

Fortinet FortiWeb — Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

KEV · due 30 JanEPSS 87%public exploitSSVC actCVSS 9.4
critical.is priorityof 100
98
CVSS 9.4 (CNA)9.4 / 10 × 3028.2In CISA KEV+3030.0EPSS percentile 99.7.997 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Affected

ProductAffectedFixed inSource
FortiWeb8.0.0 – 8.0.3–CNA
FortiWeb7.6.0 – 7.6.6–CNA
FortiWeb7.4.0 – 7.4.11–CNA
FortiNAC-F7.6.3 – 7.6.5–CNA
FortiOS7.6.0 – 7.6.5–CNA
FortiOS7.4.0 – 7.4.10–CNA
FortiOS7.2.0 – 7.2.12–CNA
FortiOS7.0.0 – 7.0.18–CNA
FortiAnalyzer7.6.0 – 7.6.5–CNA
FortiAnalyzer7.4.0 – 7.4.9–CNA
FortiAnalyzer7.2.0 – 7.2.11–CNA
FortiAnalyzer7.0.0 – 7.0.15–CNA

Scores by source

fortinet (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-26-060refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858advisoryfortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortiosrefcert-portal.siemens.com/productcert/html/ssa-975644.htmlkevcisa.gov/known-exploited-vulnerabilities-catalog