Product:
FortiAnalyzer, FortiManager, FortiOS
Summary
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Fortinet products may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to different accounts. This affects multiple versions of FortiAnalyzer, FortiManager, and FortiOS. The vulnerability is classified under CWE-288.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2026-24858 |
Exploitation
To exploit this vulnerability, an attacker must have a FortiCloud account and a registered device. If FortiCloud SSO authentication is enabled on the target devices, the attacker can bypass authentication and gain access to devices registered under other accounts. This can lead to unauthorized access and potential data breaches.
Affected Products
- FortiAnalyzer 7.6.0 through 7.6.5
- FortiAnalyzer 7.4.0 through 7.4.9
- FortiAnalyzer 7.2.0 through 7.2.11
- FortiAnalyzer 7.0.0 through 7.0.15
- FortiManager 7.6.0 through 7.6.5
- FortiManager 7.4.0 through 7.4.9
- FortiManager 7.2.0 through 7.2.11
- FortiManager 7.0.0 through 7.0.15
- FortiOS 7.6.0 through 7.6.5
- FortiOS 7.4.0 through 7.4.10
- FortiOS 7.2.0 through 7.2.12
- FortiOS 7.0.0 through 7.0.18
Mitigation
To mitigate this vulnerability, it is recommended to disable FortiCloud SSO authentication on affected devices or ensure that only trusted accounts have access. Regularly updating to the latest versions of FortiAnalyzer, FortiManager, and FortiOS can also help protect against this and other vulnerabilities.