Is CVE-2026-24858 being actively exploited?

Yes. CVE-2026-24858 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on January 27, 2026.

What is the CVSS score for CVE-2026-24858?

CVE-2026-24858 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2026-24858

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 85.8%EU EUVD: exploited

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-288
EPSS score: 85.8% (100th percentile)
In CISA KEV: Yes, added January 27, 2026
In EU EUVD: Yes (EUVD-2026-4712)
Published: January 27, 2026
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Added to the KEV catalog on January 27, 2026; federal remediation due January 30, 2026.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2026-4712 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on June 9, 2026.

View on the EU Vulnerability Database

Affected products

fortinet / fortianalyzer
fortinet / fortimanager
fortinet / fortinac-f
fortinet / fortios
fortinet / fortiproxy
fortinet / fortiweb
siemens / ruggedcom ape1808
siemens / ruggedcom ape1808 firmware

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Fortinet, Inc. FortiOS 7.0.7 - Fortinet, Inc. - Common Criteria NSCIB-CC-0590233-CR - active

References

https://cert-portal.siemens.com/productcert/html/ssa-975644.html(Third Party Advisory)
https://fortiguard.fortinet.com/psirt/FG-IR-26-060(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858(US Government Resource)
https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios(Mitigation, Vendor Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain