# Fortinet FortiCloud SSO Cross-Tenant Authentication Bypass (CVE-2026-24858)

> Two critical FortiCloud SSO authentication bypass vulnerabilities (CVE-2025-59718 / FG-IR-25-647 and CVE-2026-24858 / FG-IR-26-060) allow unauthenticated attackers to bypass FortiCloud Single Sign-On authentication on FortiOS, FortiProxy, FortiWeb, FortiManager, FortiAnalyzer, and FortiSwitchManager devices via crafted SAML messages. CVE-2025-59718 (CWE-347, Improper Verification of Cryptographic Signature, published Dec 9 2025) was the initial finding from Fortinet's internal code audit. CVE-2026-24858 (CWE-288, Authentication Bypass Using Alternate Path, published Jan 27 2026) was discovered after patched devices were STILL being exploited — a NEW attack path bypassing the December fix. Both are CRITICAL severity. Active exploitation confirmed: threat actors used malicious FortiCloud accounts (cloud-noc@mail.io, cloud-init@mail.io, heltaylor.12@tutamail.com, support@openmail.pro) to log into victim devices CROSS-TENANT — accessing FortiGate firewalls registered to OTHER organizations' FortiCloud accounts. Post-exploitation: config download + local admin account creation (audit, backup, itadmin, secadmin, support, backupadmin, deploy, remoteadmin, security, svcadmin, system, adccount) for persistence. Attacker IPs included Cloudflare-fronted infrastructure. Fortinet emergency response: locked malicious accounts Jan 22, disabled FortiCloud SSO globally Jan 26, restored with version-gating Jan 27. This is a CROSS-TENANT CLOUD SSO attack — the identity layer that was supposed to centralize trust BECAME the universal bypass. Affects potentially hundreds of thousands of FortiGate firewalls worldwide with FortiCloud SSO enabled (auto-enabled upon FortiCare registration unless explicitly disabled).

- **Published:** 2026-01-27T12:00:00Z
- **Last reviewed:** 2026-01-27T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0003
- **ID:** TL-2026-0003
- **Severity:** CRITICAL (CVSS 9.4)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 15 · **IOCs:** 59 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-24858, CVE-2025-59718

## Description

The FortiCloud SSO authentication bypass represents one of the most dangerous vulnerability classes in modern enterprise security: a CROSS-TENANT identity infrastructure compromise where the centralized authentication system designed to simplify and secure access becomes the universal bypass.

**The Identity Infrastructure — FortiCloud SSO:**

FortiCloud SSO is Fortinet's centralized cloud-based Single Sign-On service that provides:
- Administrative authentication to FortiGate firewalls, FortiProxy, FortiWeb WAFs, FortiManager, FortiAnalyzer, and FortiSwitchManager
- SAML-based authentication flow — devices trust FortiCloud as the Identity Provider (IdP)
- Auto-enabled upon FortiCare device registration unless administrator explicitly disables the toggle
- Cross-product authentication — one FortiCloud account manages devices across the Fortinet product portfolio
- Deployed across hundreds of thousands of Fortinet devices worldwide in enterprises, government, and critical infrastructure

The critical design assumption: devices TRUST that FortiCloud SSO assertions are valid and that the authenticated user has legitimate access to THAT SPECIFIC device. Both CVEs break this trust.

**CVE-2025-59718 (FG-IR-25-647) — The First Discovery:**

- **Type**: Improper Verification of Cryptographic Signature (CWE-347)
- **Severity**: Critical
- **Published**: December 9, 2025
- **Discovery**: Internal code audit by Yonghui Han and Theo Leleu of Fortinet Product Security
- **Root Cause**: FortiOS, FortiProxy, FortiWeb, and FortiSwitchManager did not properly verify the cryptographic signature of FortiCloud SSO SAML assertions
- **Impact**: Unauthenticated attacker can craft SAML messages that bypass SSO authentication
- **Affected**: FortiOS 7.0-7.6, FortiProxy 7.0-7.6, FortiSwitchManager 7.0-7.2, FortiWeb 7.4-8.0
- **Patches**: FortiOS 7.6.4+, FortiProxy 7.6.4+, FortiSwitchManager 7.2.7+, FortiWeb 7.6.5+

**CVE-2026-24858 (FG-IR-26-060) — The Second Attack Path:**

After organizations patched CVE-2025-59718, customers reported that FULLY PATCHED devices were still being compromised via FortiCloud SSO. Fortinet investigated and discovered a SECOND vulnerability — a completely different attack path.

- **Type**: Authentication Bypass Using Alternate Path or Channel (CWE-288)
- **Severity**: Critical
- **Published**: January 27, 2026
- **Root Cause**: An alternate authentication path existed that bypassed the SSO verification even on patched devices
- **Impact**: Attacker with a FortiCloud account can log into devices registered to OTHER FortiCloud accounts — CROSS-TENANT access
- **Affected**: FortiOS 7.0-7.6, FortiProxy 7.0-7.6, FortiManager 7.0-7.6, FortiAnalyzer 7.0-7.6, FortiWeb 7.4-8.0
- **Patches**: FortiOS 7.6.6+, FortiManager 7.6.6+, FortiAnalyzer 7.6.6+, FortiProxy 7.6.6+, FortiWeb 8.0.4+
- **Key difference**: CVE-2026-24858 ALSO affects FortiManager and FortiAnalyzer — extending the blast radius to management and analytics infrastructure

**Active Exploitation — The Cross-Tenant Attack:**

The exploitation pattern is devastating in its simplicity:

1. **Attacker registers a FortiCloud account** — legitimate account creation, no compromise needed
2. **Crafts SAML assertion** targeting other organizations' devices
3. **Bypasses SSO verification** to authenticate as super_admin on VICTIM devices
4. **Downloads device configuration** — containing VPN configurations, firewall rules, network topology, credentials
5. **Creates local admin account** for persistence (audit, backup, itadmin, secadmin, support, etc.)
6. **Attacker retains access** even if FortiCloud SSO is later disabled — the local admin account provides independent access

Observed attacker accounts:
- cloud-noc@mail.io
- cloud-init@mail.io
- heltaylor.12@tutamail.com
- support@openmail.pro

Observed attacker IPs (including Cloudflare-fronted):
- 104.28.244.115, 104.28.212.114, 104.28.212.115
- 104.28.195.105, 104.28.195.106
- 104.28.227.106, 104.28.227.105
- 104.28.244.114, 104.28.244.116
- 163.61.198.15, 38.54.6.28
- 37.1.209.19, 217.119.139.50

**Fortinet Emergency Response Timeline:**

- Dec 9, 2025: CVE-2025-59718 advisory published
- Jan 22, 2026: Fortinet locks malicious FortiCloud accounts being used in active exploitation
- Jan 23, 2026: Additional malicious accounts disabled
- Jan 26, 2026: Fortinet DISABLES FortiCloud SSO GLOBALLY to stop exploitation
- Jan 27, 2026: CVE-2026-24858 advisory published; FortiCloud SSO restored but version-gated — only patched devices can use SSO
- Jan 28, 2026: Confirmed third-party SAML IdPs and FortiAuthenticator NOT impacted
- Jan 30, 2026: Final patch releases published

The decision to GLOBALLY DISABLE FortiCloud SSO on Jan 26 is extraordinary — Fortinet effectively shut down their own cloud identity service for all customers worldwide to stop an active attack. This demonstrates the severity of cross-tenant SSO compromise.

**The Cross-Tenant SSO Paradigm:**

This is NOT a traditional vulnerability. It's a failure of the IDENTITY TRUST MODEL:
- The SAML assertion is the key — whoever can forge or manipulate it has access to ANY device trusting that IdP
- Cross-tenant means the attacker doesn't need to compromise the victim's account — they use their OWN account to access the victim's devices
- Auto-enablement means most FortiGate deployments have SSO enabled without the administrator's conscious decision
- The attacker gets super_admin — the highest privilege level, full configuration access
- Post-exploitation local account creation survives SSO disablement — the persistence outlives the vulnerability fix

## MITRE ATT&CK

- T1078.004 Cloud Accounts
- T1190 Exploit Public-Facing Application
- T1136.001 Local Account
- T1098 Account Manipulation
- T1552.001 Credentials In Files
- T1602.002 Network Device Configuration Dump
- T1550.001 Application Access Token
- T1021.001 Remote Desktop Protocol
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1588.002 Tool
- T1133 External Remote Services
- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1585 Establish Accounts
- T1587 Develop Capabilities
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1550 Use Alternate Authentication Material
- T1606 Forge Web Credentials
- T1684.001 Impersonation
- T1556 Modify Authentication Process
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories

## Sources

- [FG-IR-26-060: FortiCloud SSO Auth Bypass (CVE-2026-24858)](https://www.fortiguard.com/psirt/FG-IR-26-060)
- [FG-IR-25-647: FortiCloud SSO SAML Bypass (CVE-2025-59718)](https://www.fortiguard.com/psirt/FG-IR-25-647)
- [Fortinet Blog: Analysis of SSO Abuse on FortiOS](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios)
- [FortiGuard PSIRT Advisories (Feb 2026)](https://www.fortiguard.com/psirt)
- [Fortinet PSIRT Blog Index](https://www.fortinet.com/blog/psirt-blogs)
- [CISA KEV Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Fortinet Upgrade Path Tool](https://docs.fortinet.com/upgrade-tool)
- [Fortinet Post-Compromise Guidance](https://community.fortinet.com/t5/FortiGate/Technical-Tip-Recommended-steps-to-execute-in-case-of-a/ta-p/230694)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0003