Fortinet Locks Down FortiCloud SSO Amid Zero-Day Attacks

Network security giant Fortinet locked out cloud customers Tuesday from its single sign-on service until they update device firmware with a patch against active attacks exploiting an improper access control zero day.

See Also: OnDemand | Hybrid Mesh Firewalls and Microsoft Azure, Extending Your Network Security to the Cloud

Only Fortinet devices running the latest, patched firmware versions are accessible using Fortinet SSO, the company said.

The move follows attackers actively exploiting an authentication bypass vulnerability in FortiOS, FortiManager and FortiAnalyzer, now tracked as CVE-2026-24858, to gain administrator-level access to Fortinet devices, through FortiCloud SSO. The vulnerability allowed “an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts,” the company said. Fortinet disabled two FortiCloud accounts that used the flaw to log onto devices belonging to other organizations.

“The issue appears to allow for an attacker with access to a device within one organization’s FortiCloud account to pivot to another organization’s FortiGate devices via the shared FortiCloud infrastructure,” said Stephen Fewer, a senior principal researcher at cybersecurity firm Rapid7.

The vulnerability closely resembles but differs from two other FortiCloud SSO bypass vulnerabilities patched on Dec. 9, 2025, tracked as CVE-2025-59718 and CVE-2025-59719. The company said its own security team discovered those flaws during a code audit.

Cybersecurity firm Arctic Wolf reported that attackers were actively targeting and exploiting the Dec. 9 flaws, warning that “these vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages, if the FortiCloud SSO feature is enabled on affected devices.” Affected product lines included FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager.

The newly discovered CVE-2026-24858 doesn’t bypass the fixes for those vulnerabilities. It’s a completely new vulnerability, Rapid7 said on Tuesday.

The vulnerability’s discovery followed Arctic Wolf on Jan. 21 reporting seeing starting on Jan. 15 “a new cluster of automated malicious activity involving unauthorized firewall configuration changes on FortiGate devices.”

“This activity involved the creation of generic accounts intended for persistence, configuration changes granting VPN access to those accounts, as well as exfiltration of firewall configurations,” it said.

Researchers initially suspected that hackers bypassed the first set of Fortinet SSO flaws. “Recently, a small number of customers reported unexpected login activity occurring on their devices, which appeared very similar to the previous issue,” said Fortinet CISO Carl Windsor in a blog post. Investigators subsequently found “a number of cases where the exploit was to a device that had been fully upgraded to the latest release at the time of the attack, which suggested a new attack path.”

Every Fortinet device for which SSO can be enabled is potentially at risk for CVE-2026-24858. “While, at this time, only exploitation of FortiCloud SSO has been observed, this issue is applicable to all SAML SSO implementations,” Windsor said.

The Fortinet SSO service isn’t turn on by default, although any system administrator enrolling a device into the company’s customer support service would have to opt out of the service in order to not have it enabled.

To mitigate attacks against CVE-2026-24858, Fortinet’s cloud-side mitigation is effective, although also “introduces breaking changes to the FortiCloud SSO login protocol,” since it blocks access to Fortinet SSO except for devices running the latest, patched firmware, Rapid7 said. As a result, organizations that want to continue to use the functionality must update all of their Fortinet devices.

Fortinet recommends treating all device configurations as compromised, rotating all credentials that connect to the devices, including for LDAP and Active Directory accounts, and auditing logs for signs of intrusion.

The company said indicators of compromise include attackers logging in with the user accounts cloud-noc@mail.io and cloud-init@mail.io, although these could change. The company also detailed IP addresses attackers have used in this campaign, while noting that they’ve begun using Cloudflare protected domains to obscure their attacks.

More tactics, techniques and procedures tied to these intrusions: After logging into a device, in most case attackers next create a local admin account, “presumably for persistence should the SSO account become disabled,” Fortinet said. These accounts names, which might change, have included audit, backup, itadmin, secadmin and support. To better defend against these types of attacks, security experts recommend restricting administrator access to all edge devices, including firewalls and VPN gateways, given their repeat targeting by nation-state and cybercrime hackers (see: Russia’s GRU Tied to Critical Infrastructure Cloud Breaches).

The advice applies to every edge network vendor’s equipment. “Consider restricting all firewall management interface access to trusted internal networks as a security best practice across all firewall configurations, regardless of network appliance vendor,” Arctic Wolf said.