Vulnerability Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | Fortianalyzer | >= 7.0.0, <= 7.0.15 |
| Fortinet | Fortimanager | >= 7.0.0, <= 7.0.15 |
| Fortinet | Fortiproxy | >= 7.0.0, <= 7.0.22 |
| Fortinet | Fortiweb | >= 7.4.0, <= 7.4.11 |
| Fortinet | Fortios | >= 7.0.0, <= 7.0.18 |
| Siemens | Ruggedcom Ape1808 Firmware | - |
| Siemens | Ruggedcom Ape1808 | - |
Related Weaknesses (CWE)
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-060Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-975644.htmlThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
- https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortiosMitigationVendor Advisory
FAQ
What is CVE-2026-24858?
CVE-2026-24858 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 ...
How severe is CVE-2026-24858?
CVE-2026-24858 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-24858?
Check the references section above for vendor advisories and patch information. Affected products include: Fortinet Fortianalyzer, Fortinet Fortimanager, Fortinet Fortiproxy, Fortinet Fortiweb, Fortinet Fortios.