Authentication bypass affecting FortiOS, FortiManager, FortiAnalyzer, FortiProxy and FortiWeb.

FortiOS, FortiManager, FortiAnalyzer, FortiProxy and FortiWeb are network security solutions developed by Fortinet. They respectively ensure perimeter protection, centralized equipment management, log analysis, secure proxy and web application protection. These solutions are affected by a critical vulnerability labeled CVE‑2026‑24858, resulting from an access control flaw related to the FortiCloud Single Sign-On (SSO) functionality. Exploitation of this vulnerability would allow an attacker with a valid FortiCloud account and a registered device to access other devices registered in affected systems. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1.

• FortiAnalyzer: versions 7.6.5, 7.4.9, 7.0.15, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11, and 7.0.0 to 7.0.15;
• FortiManager: versions 7.6.0 to 7.6.5, 7.4.0 to 7.4.9, 7.2.0 to 7.2.11 and 7.0.0 to 7.0.15;
• FortiOS: versions 7.6.0 to 7.6.5, 7.4.0 to 7.4.10, 7.2.0 to 7.2.12 and 7.6.0 to 7.6.5;
• FortiProxy: versions 7.6.4, 7.4.12, 7.2.15 and 7.0.22;
• FortiWeb: versions 7.4.0 to 7.4.12, 7.2.0 to 7.2.15, 7.0.0 to 7.0.22, 8.0.0 to 8.0.3, 7.6.0 to 7.6.6;