--- title: Automated Attacks Exploit Fortinet FortiGate Devices via... description: Fortinet is addressing active exploitation of a critical zero-day vulnerability (CVE-2026-24858, CVSS 9.4) in FortiCloud SSO that affects FortiGate,... canonical: https://daily.dev/posts/automated-attacks-exploit-fortinet-fortigate-devices-via-vulnerable-forticloud-sso-accounts-be0qruj9q twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Automated Attacks Exploit Fortinet FortiGate Devices via Vulnerable FortiCloud SSO Accounts | daily.dev og:description: Fortinet is addressing active exploitation of a critical zero-day vulnerability (CVE-2026-24858, CVSS 9.4) in FortiCloud SSO that affects FortiGate,... og:url: https://daily.dev/posts/automated-attacks-exploit-fortinet-fortigate-devices-via-vulnerable-forticloud-sso-accounts-be0qruj9q og:image: https://api.daily.dev/og/posts/be0qruj9q.png og:image:alt: Automated Attacks Exploit Fortinet FortiGate Devices via Vulnerable FortiCloud SSO Accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Automated Attacks Exploit Fortinet FortiGate Devices via Vulnerable FortiCloud SSO Accounts **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Fortinet is addressing active exploitation of a critical zero-day vulnerability (CVE-2026-24858, CVSS 9.4) in FortiCloud SSO that affects FortiGate, FortiAnalyzer, FortiManager, and FortiProxy devices. Attackers are bypassing previous patches using crafted SAML messages to create persistent admin accounts, modify configurations, and exfiltrate data. Fortinet has temporarily disabled FortiCloud SSO and recommends immediate mitigation steps including disabling SSO logins, restricting admin access, reviewing logs, and upgrading to FortiOS 7.4.11. CISA has mandated federal agencies patch by February 17, 2026. ## Content Fortinet is currently managing active exploitation campaigns targeting FortiGate firewall devices via a critical zero-day vulnerability in the FortiCloud Single Sign-On (SSO) system. Despite previous patches aimed at addressing vulnerabilities such as CVE-2025-59718 and CVE-2025-59719, attackers have developed new methods to circumvent these fixes. This ongoing threat exploits crafted Security Assertion Markup Language (SAML) messages, allowing unauthorized access to create persistent admin accounts, modify configurations, grant VPN access, and exfiltrate sensitive data. In recent observations beginning mid-January 2026, security firm Arctic Wolf detected automated attacks leveraging SSO accounts. These attacks have been recognized for their rapid execution, capable of compromising devices and altering configurations within seconds. Victims frequently report malicious intrusions originating from specific hosting providers, suggesting a coordinated effort by threat actors who also created persistence accounts under email addresses such as cloud-noc@mail.io and cloud-init@mail.io. Alarmingly, the newly identified attack paths also impact FortiAnalyzer, FortiManager, and FortiProxy products due to the same authentication bypass flaw now cataloged under CVE-2026-24858. Given the critical CVSS score of 9.4, Fortinet has temporarily disabled the FortiCloud SSO service on January 26, with subsequent server-side changes to block vulnerable devices from authenticating until upgrades are applied. Recommendations from Fortinet emphasize the urgency of disabling FortiCloud SSO logins to mitigate immediate threats, alongside restricting administrative access via local-in policies, reviewing authentication logs, and auditing admin account changes. While Fortinet is developing subsequent patches to address these vulnerabilities, current guidance includes upgrading to FortiOS version 7.4.11 where fixes are available. Organizations should also establish protocols to monitor SSO activity closely, reset affected credentials, and restore clean configurations if a breach is suspected. The Cybersecurity and Infrastructure Security Agency (CISA) has also mandated the patching of these vulnerabilities for federal agencies by February 17, 2026. Organizations across sectors are encouraged to prioritize network security hygiene by regularly updating to the latest software versions and ensuring management interfaces are restricted to internal network access only. ## Similar posts on daily.dev - [Fortinet SSO patch bypass gets a separate critical CVE](https://daily.dev/posts/fortinet-sso-patch-bypass-gets-a-separate-critical-cve-pbbljiqf4) · The Register · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#authentication](https://daily.dev/tags/authentication), [#vulnerability](https://daily.dev/tags/vulnerability), [#firewall](https://daily.dev/tags/firewall), [#fortinet](https://daily.dev/tags/fortinet) [View this post on daily.dev](https://daily.dev/posts/automated-attacks-exploit-fortinet-fortigate-devices-via-vulnerable-forticloud-sso-accounts-be0qruj9q) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Automated Attacks Exploit Fortinet FortiGate Devices via Vulnerable FortiCloud SSO Accounts","url":"https://daily.dev/posts/automated-attacks-exploit-fortinet-fortigate-devices-via-vulnerable-forticloud-sso-accounts-be0qruj9q","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/automated-attacks-exploit-fortinet-fortigate-devices-via-vulnerable-forticloud-sso-accounts-be0qruj9q"},"datePublished":"2026-01-22T07:09:29.061Z","dateModified":"2026-01-28T21:29:56.533Z","description":"Fortinet is addressing active exploitation of a critical zero-day vulnerability (CVE-2026-24858, CVSS 9.4) in FortiCloud SSO that affects FortiGate,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a46f01390b4b6b493c1ec3bb3051226e?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a46f01390b4b6b493c1ec3bb3051226e?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/automated-attacks-exploit-fortinet-fortigate-devices-via-vulnerable-forticloud-sso-accounts-be0qruj9q","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,authentication,vulnerability,firewall,fortinet","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Automated Attacks Exploit Fortinet FortiGate Devices via Vulnerable FortiCloud SSO Accounts"}]} ```