CVE-2026-24858: Any FortiCloud account could log in to other customers' devices

What it is

FortiCloud SSO lets administrators log in to a FortiGate, FortiManager, FortiAnalyzer or FortiProxy with their FortiCloud account instead of a local password. On affected versions, the device didn’t properly check which FortiCloud account was logging in. Anyone with their own FortiCloud account and a registered device could log in as an administrator to devices registered to other customers.

Attackers used it to create local admin accounts for persistence and to download device configurations, which hold VPN settings, user accounts and secrets. It worked on FortiGates that were fully patched against the previous FortiCloud SSO bug, CVE-2025-59718, exploited six weeks earlier.

Fortinet shut the feature off on its side on 26 January 2026 and turned it back on a day later only for fixed versions. That stopped the attacks centrally, but any admin accounts and configuration copies the attackers already had stayed with them.

Am I affected?

Only devices with FortiCloud SSO admin login enabled. It’s off by default, but registering a device to FortiCare from its GUI turns it on unless you switch off Allow administrative login using FortiCloud SSO on the registration page. Many devices have it on without anyone deciding to.

Check:

• FortiOS / FortiProxy: System > Settings > Allow administrative login using FortiCloud SSO, or get system global | grep forticloud.
• FortiManager / FortiAnalyzer: System Settings > SAML SSO > Allow admins to login with FortiCloud.

Not affected: FortiOS 8.0 and 6.4, FortiGate Cloud, FortiManager Cloud and FortiAnalyzer Cloud, and setups that use your own identity provider (including FortiAuthenticator) instead of FortiCloud.

What to do

1. Upgrade to a fixed release (table above). Since Fortinet’s fix, FortiCloud SSO only works on fixed versions anyway.

2. Turn FortiCloud SSO login off unless you actively use it. The fewer cloud-reachable login paths, the better:

config system global
    set admin-forticloud-sso-login disable
end

On FortiManager and FortiAnalyzer:

config system saml
    set forticloud-sso disable
end

3. Check every device that had it enabled before 27 January 2026, whatever its version today:

• Admin accounts you didn’t create. Names seen by Fortinet: audit, backup, itadmin, secadmin, support, backupadmin, deploy, remoteadmin, security, svcadmin, system. Attackers change names, so review the whole list.
• SSO logins from the accounts and addresses below.
• Configuration downloads you can’t explain.

4. If anything turns up, delete the rogue accounts and assume the configuration was stolen. Rotate local admin and VPN user passwords, LDAP and RADIUS secrets, and IPsec pre-shared keys.

Detection

• Admin login events with the FortiCloud SSO method, especially from the email accounts listed below or from addresses that aren’t your admins’.
• New administrator creation (configuration change logs for system admin) shortly after an SSO login.
• Configuration backups or downloads in system event logs right after an SSO login.
• In FortiManager and FortiAnalyzer, the same checks for SAML/FortiCloud logins and new admins.