A critical authentication bypass in FortiOS, FortiManager, FortiAnalyzer and other Fortinet products was exploited in the wild. Fixed versions and checks.
Fortinet firewalls protect many companies in Armenia and around the world. In January 2026 Fortinet disclosed CVE-2026-24858 — an authentication bypass in the FortiCloud single sign-on (SSO) login for administrators. Fortinet confirmed it was exploited in the wild, and CISA added it to its catalog of exploited vulnerabilities. Many devices are still not updated.
If “administrative login using FortiCloud SSO” is enabled, an attacker with their own FortiCloud account and registered device could log in as an administrator on other customers' devices. Fortinet rates it critical, CVSS 9.8.
| Product | Vulnerable | Update to |
|---|---|---|
| FortiOS 7.6 | 7.6.0 – 7.6.5 | 7.6.6+ |
| FortiOS 7.4 | 7.4.0 – 7.4.10 | 7.4.11+ |
| FortiOS 7.2 | 7.2.0 – 7.2.12 | 7.2.13+ |
| FortiOS 7.0 | 7.0.0 – 7.0.18 | 7.0.19+ |
| FortiManager / FortiAnalyzer 7.6 | 7.6.0 – 7.6.5 | 7.6.6+ |
| FortiManager / FortiAnalyzer 7.4 | 7.4.0 – 7.4.9 | 7.4.10+ |
| FortiProxy, FortiWeb, FortiSwitchManager, FortiNAC-F | see the Fortinet advisory FG-IR-26-060 | |
FortiOS 8.0 and 6.4 are not affected. FortiCloud SSO now refuses logins from vulnerable versions, so devices that are not updated also lose this login method.
config system global → set admin-forticloud-sso-login disable → end.trusted hosts) or through VPN.CISA has added several other Fortinet vulnerabilities to its exploited catalog in 2026. Check Fortinet PSIRT regularly — firewalls are one of the most attacked devices on any network.
The firewall protects everything behind it. If it is not updated, it protects nothing.
CySec is a Fortinet integrator: we update FortiGate devices, review their configuration and monitor them, so critical patches are not missed.
Sources: Fortinet PSIRT FG-IR-26-060, CISA KEV catalog.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.