Fortinet pushes emergency patches after FortiCloud SSO zero‑day lets attackers cross account boundaries

Fortinet rushed out emergency updates this week after security researchers and defenders observed automated attacks taking advantage of a FortiCloud single‑sign‑on authentication bypass. Tracked as CVE‑2026‑24858, the vulnerability provides an alternate authentication path that can enable a valid FortiCloud account to reach devices registered to other customers. Early attack telemetry showed attempts to create administrative profiles and export device configurations, which triggered a concentrated investigation and mitigations. Fortinet reported it blocked the malicious FortiCloud accounts tied to the activity and temporarily disabled cloud‑based SSO while engineers built and validated fixes. The vendor published patches for multiple core products — including specific builds of FortiOS, FortiManager and FortiAnalyzer — and said additional maintenance releases across supported branches will include the corrective code. U.S. authorities escalated the response: the Cybersecurity and Infrastructure Security Agency added the CVE to its Known Exploited Vulnerabilities catalog and issued an accelerated remediation deadline for federal customers. The flaw is especially concerning because FortiCloud SSO is often enabled automatically during common device onboarding workflows unless administrators change defaults, increasing exposure during initial registration. This episode fits a broader pattern seen over the past week in which high‑impact flaws move from discovery to active exploitation quickly, compressing defenders’ patching windows and raising operational strain on incident responders. Practical mitigation therefore extends beyond applying vendor updates: organizations should assume exposure until patched, audit FortiCloud registrations and administrative changes, disable cloud SSO where it’s not required, rotate credentials, and search logs for signs of unauthorized profile creation or configuration exports. For federal and critical‑infrastructure operators the CISA listing mandates immediate action and intensifies resource demands. In short, this is a live, high‑severity vulnerability that underscores the tradeoff between automated convenience and default security, and it requires rapid patching plus focused operational hygiene to limit attacker movement and data exfiltration.