PT-2026-5008 · Fortinet · Fortianalyzer+2

Michele Damico · Published 2026-01-27 · Updated 2026-05-12 · CVE-2026-24858

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions 7.6.0 through 7.6.5 FortiAnalyzer versions 7.4.0 through 7.4.9 FortiAnalyzer versions 7.2.0 through 7.2.11 FortiAnalyzer versions 7.0.0 through 7.0.15 FortiManager versions 7.6.0 through 7.6.5 FortiManager versions 7.4.0 through 7.4.9 FortiManager versions 7.2.0 through 7.2.11 FortiManager versions 7.0.0 through 7.0.15 FortiOS versions 7.6.0 through 7.6.5 FortiOS versions 7.4.0 through 7.4.10 FortiOS versions 7.2.0 through 7.2.12 FortiOS versions 7.0.0 through 7.0.18 FortiProxy versions 7.6.0 through 7.6.4 FortiProxy versions 7.4.0 through 7.4.12 FortiProxy versions 7.2.0 through 7.2.15 FortiProxy versions 7.0.0 through 7.0.22 FortiWeb versions 8.0.0 through 8.0.3 FortiWeb versions 7.6.0 through 7.6.6 FortiWeb versions 7.4.0 through 7.4.11

Description An authentication bypass flaw exists in the FortiCloud single sign-on (SSO) system. This issue allows an attacker possessing a FortiCloud account and a registered device to log into other devices registered to different accounts, provided that FortiCloud SSO authentication is enabled on those target devices. This flaw can be used to create unauthorized administrative accounts and gain administrative access to managed devices. The issue has been actively exploited by sophisticated threat actors, including the Chinese state-sponsored group Mustang Panda, to target critical infrastructure and technology sectors for data exfiltration and long-term access.

Recommendations Disable FortiCloud SSO for non-essential systems until a permanent patch is available. Enforce multi-factor authentication (MFA) for all administrative accounts. Monitor for unusual login activity, such as unexpected SSO connections or changes to user permissions.

Fix

LPE

RCE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2026-00882

CVE-2026-24858

Affected Products

Fortianalyzer

Fortimanager

Fortios

References · 234

• https://fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-26-060 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24858 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-24858 · Security Note
• https://twitter.com/ThreatSynop/status/2017044186013307227 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-975644.html · Note
• https://twitter.com/404LABSx/status/2016466834497610053 · Twitter Post
• https://twitter.com/transilienceai/status/2020171820628889936 · Twitter Post
• https://twitter.com/dailytechonx/status/2017666949367427306 · Twitter Post
• https://twitter.com/twelvesec/status/2017655120851349602 · Twitter Post
• https://twitter.com/catnap707/status/2016633654030848108 · Twitter Post
• https://twitter.com/PoseidonTPA/status/2016315440730190025 · Twitter Post
• https://twitter.com/Shadowserver/status/2016583036926562379 · Twitter Post
• https://t.me/cibsecurity/88390 · Telegram Post