onyx --cves cve-2026-24858
CVE-2026-24858
- score
- 0.2
- cvss
- 9.8
- epss
- 85.8%
- published
- 2026-01-27
- kev added
- 2026-01-27
- first seen
Fortinet FortiAnalyzer, FortiManager, and FortiOS versions 7.0.0 through 7.6.5 contain an authentication bypass caused by FortiCloud SSO allowing cross-account device login, letting attackers with FortiCloud accounts access other registered devices, exploit requires FortiCloud SSO enabled and registered device.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 13
- https://cydome.io/maritime-cybersecurity-bulletin-september-11th-2026/
- https://cyble.com/reports/H1-2026-Global-Threat-Landscape-Report.pdf
- https://www.wiz.io/blog/agentless-threat-hunting-fortigate
- https://blog.qualys.com/vulnerabilities-threat-research/2026/07/08/fortibleed-fortigate-credential-reuse-internet-exposed
- https://www.trendmicro.com/vinfo/gb/security/news/cybercrime-and-digital-threats/edge-under-siege-how-state-sponsored-actors-exploit-your-perimeter
- https://fortgale.com/blog/defence/operation-storming-tide/
- https://www.sentinelone.com/blog/fortigate-edge-intrusions/
- https://www.levelblue.com/blogs/spiderlabs-blog/ttp-briefing-q2-2026
- https://www.techgines.com/post/fortibleed-fortigate-credential-compromise-86000-firewalls
- https://www.recordedfuture.com/blog/january-2026-cve-landscape
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858
- https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios
- https://cert-portal.siemens.com/productcert/html/ssa-975644.html