Vulnerability-Lookup

CVE-2026-24858 (GCVE-0-2026-24858)

Vulnerability from cvelistv5 – Published: 2026-01-27 19:18 – Updated: 2026-06-09 14:27

CISA Shadowserver Previdian

Summary

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Severity

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-28 04:55 UTC

CWE

CWE-288 - Improper access control

Assigner

fortinet CNA under the mitre root

CNA scorecard C 72/100 over 145 records in the last 180 days details

References

4 references

URL	Tags
https://fortiguard.fortinet.com/psirt/FG-IR-26-060
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://www.fortinet.com/blog/psirt-blogs/analysi…	vendor-advisory
https://cert-portal.siemens.com/productcert/html/…

Impacted products

7 products

Vendor	Product	Version	CPE status
Fortinet	FortiWeb	Affected: 8.0.0 , ≤ 8.0.3 (semver) Affected: 7.6.0 , ≤ 7.6.6 (semver) Affected: 7.4.0 , ≤ 7.4.11 (semver) cpe:2.3:a:fortinet:fortiweb:8.0.3:::::::* cpe:2.3:a:fortinet:fortiweb:8.0.2:::::::* cpe:2.3:a:fortinet:fortiweb:8.0.1:::::::* cpe:2.3:a:fortinet:fortiweb:8.0.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.6:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.5:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.6.0:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.11:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.10:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.9:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.8:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.7:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.6:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.5:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.4:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.3:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.2:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.1:::::::* cpe:2.3:a:fortinet:fortiweb:7.4.0:::::::*
Fortinet	FortiNAC-F	Affected: 7.6.3 , ≤ 7.6.5 (semver)	guessed
Fortinet	FortiOS	Affected: 7.6.0 , ≤ 7.6.5 (semver) Affected: 7.4.0 , ≤ 7.4.10 (semver) Affected: 7.2.0 , ≤ 7.2.12 (semver) Affected: 7.0.0 , ≤ 7.0.18 (semver) cpe:2.3:o:fortinet:fortios:7.6.5:::::::* cpe:2.3:o:fortinet:fortios:7.6.4:::::::* cpe:2.3:o:fortinet:fortios:7.6.3:::::::* cpe:2.3:o:fortinet:fortios:7.6.2:::::::* cpe:2.3:o:fortinet:fortios:7.6.1:::::::* cpe:2.3:o:fortinet:fortios:7.6.0:::::::* cpe:2.3:o:fortinet:fortios:7.4.10:::::::* cpe:2.3:o:fortinet:fortios:7.4.9:::::::* cpe:2.3:o:fortinet:fortios:7.4.8:::::::* cpe:2.3:o:fortinet:fortios:7.4.7:::::::* cpe:2.3:o:fortinet:fortios:7.4.6:::::::* cpe:2.3:o:fortinet:fortios:7.4.5:::::::* cpe:2.3:o:fortinet:fortios:7.4.4:::::::* cpe:2.3:o:fortinet:fortios:7.4.3:::::::* cpe:2.3:o:fortinet:fortios:7.4.2:::::::* cpe:2.3:o:fortinet:fortios:7.4.1:::::::* cpe:2.3:o:fortinet:fortios:7.4.0:::::::* cpe:2.3:o:fortinet:fortios:7.2.12:::::::* cpe:2.3:o:fortinet:fortios:7.2.11:::::::* cpe:2.3:o:fortinet:fortios:7.2.10:::::::* cpe:2.3:o:fortinet:fortios:7.2.9:::::::* cpe:2.3:o:fortinet:fortios:7.2.8:::::::* cpe:2.3:o:fortinet:fortios:7.2.7:::::::* cpe:2.3:o:fortinet:fortios:7.2.6:::::::* cpe:2.3:o:fortinet:fortios:7.2.5:::::::* cpe:2.3:o:fortinet:fortios:7.2.4:::::::* cpe:2.3:o:fortinet:fortios:7.2.3:::::::* cpe:2.3:o:fortinet:fortios:7.2.2:::::::* cpe:2.3:o:fortinet:fortios:7.2.1:::::::* cpe:2.3:o:fortinet:fortios:7.2.0:::::::* cpe:2.3:o:fortinet:fortios:7.0.18:::::::* cpe:2.3:o:fortinet:fortios:7.0.17:::::::* cpe:2.3:o:fortinet:fortios:7.0.16:::::::* cpe:2.3:o:fortinet:fortios:7.0.15:::::::* cpe:2.3:o:fortinet:fortios:7.0.14:::::::* cpe:2.3:o:fortinet:fortios:7.0.13:::::::* cpe:2.3:o:fortinet:fortios:7.0.12:::::::* cpe:2.3:o:fortinet:fortios:7.0.11:::::::* cpe:2.3:o:fortinet:fortios:7.0.10:::::::* cpe:2.3:o:fortinet:fortios:7.0.9:::::::* cpe:2.3:o:fortinet:fortios:7.0.8:::::::* cpe:2.3:o:fortinet:fortios:7.0.7:::::::* cpe:2.3:o:fortinet:fortios:7.0.6:::::::* cpe:2.3:o:fortinet:fortios:7.0.5:::::::* cpe:2.3:o:fortinet:fortios:7.0.4:::::::* cpe:2.3:o:fortinet:fortios:7.0.3:::::::* cpe:2.3:o:fortinet:fortios:7.0.2:::::::* cpe:2.3:o:fortinet:fortios:7.0.1:::::::* cpe:2.3:o:fortinet:fortios:7.0.0:::::::*
Fortinet	FortiAnalyzer	Affected: 7.6.0 , ≤ 7.6.5 (semver) Affected: 7.4.0 , ≤ 7.4.9 (semver) Affected: 7.2.0 , ≤ 7.2.11 (semver) Affected: 7.0.0 , ≤ 7.0.15 (semver) cpe:2.3:o:fortinet:fortianalyzer:7.6.5:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.6.4:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.6.3:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.6.2:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.6.1:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.6.0:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.9:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.8:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.7:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.6:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.5:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.4:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.3:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.2:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.1:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.4.0:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.11:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.10:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.9:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.8:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.7:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.6:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.5:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.4:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.3:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.2:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.1:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.2.0:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.15:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.14:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.13:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.12:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.11:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.10:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.9:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.8:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.7:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.6:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.5:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.4:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.3:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.2:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.1:::::::* cpe:2.3:o:fortinet:fortianalyzer:7.0.0:::::::*
Fortinet	FortiProxy	Affected: 7.6.0 , ≤ 7.6.4 (semver) Affected: 7.4.0 , ≤ 7.4.12 (semver) Affected: 7.2.0 , ≤ 7.2.15 (semver) Affected: 7.0.0 , ≤ 7.0.22 (semver) cpe:2.3:a:fortinet:fortiproxy:7.6.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.6.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.12:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.11:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.10:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.9:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.8:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.7:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.6:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.5:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.4.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.15:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.14:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.13:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.12:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.11:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.10:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.9:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.8:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.7:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.6:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.5:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.2.0:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.22:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.21:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.20:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.19:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.18:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.17:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.16:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.15:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.14:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.13:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.12:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.11:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.10:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.9:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.8:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.7:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.6:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.5:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.4:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.3:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.2:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.1:::::::* cpe:2.3:a:fortinet:fortiproxy:7.0.0:::::::*
Fortinet	FortiManager	Affected: 7.6.0 , ≤ 7.6.5 (semver) Affected: 7.4.0 , ≤ 7.4.9 (semver) Affected: 7.2.0 , ≤ 7.2.11 (semver) Affected: 7.0.0 , ≤ 7.0.15 (semver) cpe:2.3:o:fortinet:fortimanager:7.6.5:::::::* cpe:2.3:o:fortinet:fortimanager:7.6.4:::::::* cpe:2.3:o:fortinet:fortimanager:7.6.3:::::::* cpe:2.3:o:fortinet:fortimanager:7.6.2:::::::* cpe:2.3:o:fortinet:fortimanager:7.6.1:::::::* cpe:2.3:o:fortinet:fortimanager:7.6.0:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.9:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.8:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.7:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.6:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.5:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.4:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.3:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.2:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.1:::::::* cpe:2.3:o:fortinet:fortimanager:7.4.0:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.11:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.10:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.9:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.8:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.7:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.6:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.5:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.4:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.3:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.2:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.1:::::::* cpe:2.3:o:fortinet:fortimanager:7.2.0:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.15:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.14:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.13:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.12:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.11:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.10:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.9:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.8:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.7:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.6:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.5:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.4:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.3:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.2:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.1:::::::* cpe:2.3:o:fortinet:fortimanager:7.0.0:::::::*
Siemens	RUGGEDCOM APE1808	Affected: 0 , < * (custom)	guessed

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: e1546c5c-ee29-412d-8453-540ce5e9e017

Vulnerability ID: CVE-2026-24858

Status: Confirmed

Status Updated: 2026-01-27 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2026-01-27

Asserted: 2026-01-27

Scope

Notes: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability | Affected: Fortinet / Multiple Products | Description: Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices. | Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. | Due date: 2026-01-30 | Known ransomware campaign use (KEV): Unknown | Notes (KEV): Please adhere to Fortinet's guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-060 ; https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios ; https://nvd.nist.gov/vuln/detail/CVE-2026-24858

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-288
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Multiple Products
Due Date	2026-01-30
Date Added	2026-01-27
Vendorproject	Fortinet
Vulnerabilityname	Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Knownransomwarecampaignuse	Unknown

References

CVE-2026-24858

Created: 2026-02-02 12:25 UTC | Updated: 2026-11-04 13:37 UTC

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 55f0cb3e-3687-4b4c-a9ef-2c4bc2c0ceb4

Vulnerability ID: CVE-2026-24858

Status: Confirmed

Status Updated: 2026-11-12 00:00 UTC

Exploited: Yes

Characteristics

Severity: 98.0

Timestamps

First Seen: 2026-11-08

Asserted: 2026-11-08

Last Seen: 2026-11-12

Scope

Asset Exposure: ['internet-facing']

Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details

1D	1
Iot	no
Feed	Shadowserver Foundation honeypot/exploited-vulnerabilities
Type	http-scan
Class	firewall
7D Avg	0
Vendor	Fortinet
30D Avg	0
90D Avg	0
Product	Fortinet Multiple Products
Cisa Kev	yes
Connections	1
Observation Date	2026-11-12
Vulnerability Class	CVSS
Vulnerability Score	9.8
Vulnerability Severity	Critical

References

Created: 2026-11-10 01:03 UTC | Updated: 2026-11-14 01:01 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: b2870015-f508-4079-b371-97370d32a7cb

Vulnerability ID: CVE-2026-24858

Status: Confirmed

Status Updated: 2026-06-01 10:49 UTC

Exploited: Yes

Timestamps

First Seen: 2026-06-01

Asserted: 2026-06-01

Scope

Notes: KEVIntel entry: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5,... | Affected: Fortinet / FortiWeb, FortiNAC-F, FortiOS, FortiAnalyzer, FortiProxy, FortiManager | CVSS: 9.4 (CRITICAL) | EPSS: 0.55125 | Used in malware: unknown | Not yet in CISA KEV: False

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5,...
Vendor	Fortinet
Product	FortiWeb, FortiNAC-F, FortiOS, FortiAnalyzer, FortiProxy, FortiManager
Added Date	2026-06-01T10:49:56.043Z
Cvss Score	9.4
Epss Score	0.55125
Cvss Severity	CRITICAL
Epss Percentile	0.98899
Used In Malware	unknown
Ahead Of Cisa Kev	`{ "count": 1, "unit": "day" }`
Not Yet In Cisa Kev	False

References

Created: 2026-06-23 14:03 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-24858",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-28T04:55:41.959755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-01-27",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T15:04:50.331Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858"
          },
          {
            "tags": [
              "vendor-advisory"
            ],
            "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM APE1808",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T12:08:56.335Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiweb:8.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiWeb",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.3",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.6",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [],
          "defaultStatus": "unaffected",
          "product": "FortiNAC-F",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiOS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.10",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.12",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.18",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAnalyzer",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.9",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.11",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiProxy",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.4",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.12",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.15",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.22",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.9",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.11",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-288",
              "description": "Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T14:27:53.379Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to upcoming  FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.6 or above\nUpgrade to FortiOS version 7.4.11 or above\nUpgrade to FortiOS version 7.2.13 or above\nUpgrade to FortiOS version 7.0.19 or above\nUpgrade to upcoming  FortiManager version 8.0.0 or above\nUpgrade to FortiManager version 7.6.6 or above\nUpgrade to FortiManager version 7.4.10 or above\nUpgrade to FortiManager version 7.2.12 or above\nUpgrade to FortiManager version 7.0.16 or above\nUpgrade to FortiAnalyzer version 7.6.6 or above\nUpgrade to FortiAnalyzer version 7.4.10 or above\nUpgrade to FortiAnalyzer version 7.2.12 or above\nUpgrade to FortiAnalyzer version 7.0.16 or above\nUpgrade to FortiProxy version 7.6.5 or above\nUpgrade to FortiProxy version 7.4.13 or above\nUpgrade to FortiProxy version 7.2.16 or above\nUpgrade to FortiProxy version 7.0.23 or above\nUpgrade to FortiWeb version 8.0.4 or above\nUpgrade to FortiWeb version 7.6.7 or above\nUpgrade to FortiWeb version 7.4.12 or above\nUpgrade to FortiNAC-F version 7.6.6 or above\nUpgrade to FortiSwitchManager version 7.2.9 or above\nUpgrade to FortiSwitchManager version 7.0.8 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2026-24858",
    "datePublished": "2026-01-27T19:18:23.591Z",
    "dateReserved": "2026-01-27T15:11:02.057Z",
    "dateUpdated": "2026-06-09T14:27:53.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-24858",
      "cwes": [
        "CWE-288"
      ],
      "dateAdded": "2026-01-27",
      "dueDate": "2026-01-30",
      "forensicTriage": "No",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "Please adhere to Fortinet\u0027s guidelines to assess exposure and mitigate risks. Check for signs of potential compromise on all internet accessible Fortinet products affected by this vulnerability. Apply any final mitigations provided by the vendor as soon as they become available. For more information please see: https://fortiguard.fortinet.com/psirt/FG-IR-26-060 ; https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios ; https://nvd.nist.gov/vuln/detail/CVE-2026-24858",
      "product": "Multiple Products",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.",
      "vendorProject": "Fortinet",
      "vulnerabilityName": "Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability"
    },
    "epss": {
      "cve": "CVE-2026-24858",
      "date": "2026-11-13",
      "epss": "0.86592",
      "percentile": "0.99745"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:fortiweb:8.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiWeb",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "8.0.3",
                    "status": "affected",
                    "version": "8.0.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.6.6",
                    "status": "affected",
                    "version": "7.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.4.11",
                    "status": "affected",
                    "version": "7.4.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "FortiNAC-F",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.6.5",
                    "status": "affected",
                    "version": "7.6.3",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiOS",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.6.5",
                    "status": "affected",
                    "version": "7.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.4.10",
                    "status": "affected",
                    "version": "7.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.12",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.18",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiAnalyzer",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.6.5",
                    "status": "affected",
                    "version": "7.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.4.9",
                    "status": "affected",
                    "version": "7.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.11",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.15",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.12:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiProxy",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.6.4",
                    "status": "affected",
                    "version": "7.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.4.12",
                    "status": "affected",
                    "version": "7.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.15",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.22",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*",
                  "cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "product": "FortiManager",
                "vendor": "Fortinet",
                "versions": [
                  {
                    "lessThanOrEqual": "7.6.5",
                    "status": "affected",
                    "version": "7.6.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.4.9",
                    "status": "affected",
                    "version": "7.4.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.11",
                    "status": "affected",
                    "version": "7.2.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.15",
                    "status": "affected",
                    "version": "7.0.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "psirt@fortinet.com"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM APE1808",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "cisaActionDue": "2026-01-30",
        "cisaExploitAdd": "2026-01-27",
        "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
        "cisaVulnerabilityName": "Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F2B61F1F-19A9-4BA6-B12A-ECA95C5634A3",
                    "versionEndIncluding": "7.0.15",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D467D1D8-1BCF-4A88-8EEE-0D8092C3AE9C",
                    "versionEndIncluding": "7.2.11",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD96750D-104E-4DAE-A19E-8C92E85429F4",
                    "versionEndExcluding": "7.4.10",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BDF7BF56-B998-4AAE-9B6D-C6F009F8B807",
                    "versionEndExcluding": "7.6.6",
                    "versionStartIncluding": "7.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "651E452B-3C1D-4738-BDFF-7234B19C63F7",
                    "versionEndIncluding": "7.0.15",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36D9D75F-B292-4651-8BF0-20AFE2C016C4",
                    "versionEndIncluding": "7.2.11",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3AF70FA9-34D3-4ADF-B87C-A9C31D4DC174",
                    "versionEndExcluding": "7.4.10",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "357DA889-E7C0-42B6-96A5-83C0D9E6CC69",
                    "versionEndExcluding": "7.6.6",
                    "versionStartIncluding": "7.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortinac-f:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A43635C7-3F54-43F7-A193-A4C361685A43",
                    "versionEndExcluding": "7.6.6",
                    "versionStartIncluding": "7.6.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "63D22275-D430-4F99-9170-C8378FF80242",
                    "versionEndIncluding": "7.0.22",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33FE9C6F-F5A1-43E4-917E-32497D6CC5A6",
                    "versionEndIncluding": "7.2.15",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DA34D10C-0B80-4A37-94D2-CD05E865E149",
                    "versionEndIncluding": "7.4.12",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A26D8D81-00EE-4A11-B693-DE85B912F267",
                    "versionEndIncluding": "7.6.4",
                    "versionStartIncluding": "7.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "64C16483-DF84-43AA-B5D4-FA8939E4F387",
                    "versionEndIncluding": "7.4.11",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B40750AD-AE67-42C3-89A5-E64F3D7F0431",
                    "versionEndIncluding": "7.6.6",
                    "versionStartIncluding": "7.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EDCDD451-D984-4EC9-AB30-42D553FF0BD7",
                    "versionEndIncluding": "8.0.3",
                    "versionStartIncluding": "8.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A0CDFB7-0B78-4B3E-9E19-34E5F2479271",
                    "versionEndIncluding": "7.0.18",
                    "versionStartIncluding": "7.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "25DF0315-DF9C-4C51-9902-ED607B049152",
                    "versionEndIncluding": "7.2.12",
                    "versionStartIncluding": "7.2.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2ADAF67E-132B-4810-8919-38AC80BF59F5",
                    "versionEndExcluding": "7.4.11",
                    "versionStartIncluding": "7.4.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "96C45B06-625A-4EFE-A720-242E33611B50",
                    "versionEndExcluding": "7.6.6",
                    "versionStartIncluding": "7.6.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "37FDCA69-9049-40B4-88AF-F476901022B6",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B89A6863-B602-4404-8D26-337FECABFFF0",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n usando una ruta o canal alternativo [CWE-288] en Fortinet FortiAnalyzer 7.6.0 hasta 7.6.5, FortiAnalyzer 7.4.0 hasta 7.4.9, FortiAnalyzer 7.2.0 hasta 7.2.11, FortiAnalyzer 7.0.0 hasta 7.0.15, FortiManager 7.6.0 hasta 7.6.5, FortiManager 7.4.0 hasta 7.4.9, FortiManager 7.2.0 hasta 7.2.11, FortiManager 7.0.0 hasta 7.0.15, FortiOS 7.6.0 hasta 7.6.5, FortiOS 7.4.0 hasta 7.4.10, FortiOS 7.2.0 hasta 7.2.12, FortiOS 7.0.0 hasta 7.0.18, FortiProxy 7.6.0 hasta 7.6.4, FortiProxy 7.4.0 hasta 7.4.12, FortiProxy 7.2.0 hasta 7.2.15, FortiProxy 7.0.0 hasta 7.0.22, FortiWeb 8.0.0 hasta 8.0.3, FortiWeb 7.6.0 hasta 7.6.6, FortiWeb 7.4.0 hasta 7.4.11 puede permitir a un atacante con una cuenta de FortiCloud y un dispositivo registrado iniciar sesi\u00f3n en otros dispositivos registrados en otras cuentas, si la autenticaci\u00f3n SSO de FortiCloud est\u00e1 habilitada en esos dispositivos."
          }
        ],
        "id": "CVE-2026-24858",
        "lastModified": "2026-06-17T10:23:43.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "psirt@fortinet.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-24858",
                "options": [
                  {
                    "exploitation": "active"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-28T04:55:41.959755Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-01-27T20:16:24.477",
        "references": [
          {
            "source": "psirt@fortinet.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "US Government Resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios"
          }
        ],
        "sourceIdentifier": "psirt@fortinet.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-288"
              }
            ],
            "source": "psirt@fortinet.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-06-09T20:59:29+00:00",
      "cve": "CVE-2026-24858",
      "id": "CVE-2026-24858",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2026-24858",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24858.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM APE1808",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-12T12:08:56.335Z",
              "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
              "shortName": "siemens-SADP"
            },
            "references": [
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html"
              }
            ],
            "x_adpType": "supplier"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-24858",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-01-28T04:55:41.959755Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-01-27",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-01-27T19:30:19.472Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858"
              },
              {
                "tags": [
                  "vendor-advisory"
                ],
                "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "cpes": [
                "cpe:2.3:a:fortinet:fortiweb:8.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiWeb",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "8.0.3",
                  "status": "affected",
                  "version": "8.0.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.6.6",
                  "status": "affected",
                  "version": "7.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.4.11",
                  "status": "affected",
                  "version": "7.4.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [],
              "defaultStatus": "unaffected",
              "product": "FortiNAC-F",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.6.5",
                  "status": "affected",
                  "version": "7.6.3",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiOS",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.6.5",
                  "status": "affected",
                  "version": "7.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.4.10",
                  "status": "affected",
                  "version": "7.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.2.12",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.18",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiAnalyzer",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.6.5",
                  "status": "affected",
                  "version": "7.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.4.9",
                  "status": "affected",
                  "version": "7.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.2.11",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.15",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiProxy",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.6.4",
                  "status": "affected",
                  "version": "7.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.4.12",
                  "status": "affected",
                  "version": "7.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.2.15",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.22",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "cpes": [
                "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*",
                "cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "product": "FortiManager",
              "vendor": "Fortinet",
              "versions": [
                {
                  "lessThanOrEqual": "7.6.5",
                  "status": "affected",
                  "version": "7.6.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.4.9",
                  "status": "affected",
                  "version": "7.4.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.2.11",
                  "status": "affected",
                  "version": "7.2.0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "7.0.15",
                  "status": "affected",
                  "version": "7.0.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-288",
                  "description": "Improper access control",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-09T14:27:53.379Z",
            "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
            "shortName": "fortinet"
          },
          "references": [
            {
              "name": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060",
              "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to upcoming  FortiOS version 8.0.0 or above\nUpgrade to FortiOS version 7.6.6 or above\nUpgrade to FortiOS version 7.4.11 or above\nUpgrade to FortiOS version 7.2.13 or above\nUpgrade to FortiOS version 7.0.19 or above\nUpgrade to upcoming  FortiManager version 8.0.0 or above\nUpgrade to FortiManager version 7.6.6 or above\nUpgrade to FortiManager version 7.4.10 or above\nUpgrade to FortiManager version 7.2.12 or above\nUpgrade to FortiManager version 7.0.16 or above\nUpgrade to FortiAnalyzer version 7.6.6 or above\nUpgrade to FortiAnalyzer version 7.4.10 or above\nUpgrade to FortiAnalyzer version 7.2.12 or above\nUpgrade to FortiAnalyzer version 7.0.16 or above\nUpgrade to FortiProxy version 7.6.5 or above\nUpgrade to FortiProxy version 7.4.13 or above\nUpgrade to FortiProxy version 7.2.16 or above\nUpgrade to FortiProxy version 7.0.23 or above\nUpgrade to FortiWeb version 8.0.4 or above\nUpgrade to FortiWeb version 7.6.7 or above\nUpgrade to FortiWeb version 7.4.12 or above\nUpgrade to FortiNAC-F version 7.6.6 or above\nUpgrade to FortiSwitchManager version 7.2.9 or above\nUpgrade to FortiSwitchManager version 7.0.8 or above"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "assignerShortName": "fortinet",
        "cveId": "CVE-2026-24858",
        "datePublished": "2026-01-27T19:18:23.591Z",
        "dateReserved": "2026-01-27T15:11:02.057Z",
        "dateUpdated": "2026-06-09T14:27:53.379Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0097

Vulnerability from certfr_avis - Published: 2026-01-28 - Updated: 2026-01-28

Une vulnérabilité a été découverte dans les produits Fortinet. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Fortinet indique que la vulnérabilité CVE-2026-24858 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur indique avoir désactivé l'authentification avec FortiCloud SSO pour les versions vulnérables. Des indicateurs de compromission sont disponibles dans l'avis éditeur.

Impacted products

Vendor	Product	Description
Fortinet	FortiManager	FortiManager versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiManager	FortiManager versions 7.0.x antérieures à 7.0.16 (à venir)
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.4.x antérieures à 7.4.10
Fortinet	FortiProxy	FortiProxy versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiOS	FortiOS versions 7.4.x antérieures à 7.4.11
Fortinet	FortiManager	FortiManager versions 7.4.x antérieures à 7.4.10
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiProxy	FortiProxy versions antérieures à 7.4.13 (à venir)
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.2.x antérieures à 7.2.12 (à venir)
Fortinet	FortiOS	FortiOS versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.0.x antérieures à 7.0.16 (à venir)
Fortinet	FortiOS	FortiOS versions 7.0.x antérieures à 7.0.19 (à venir)
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.13 (à venir)
Fortinet	FortiManager	FortiManager versions 7.2.x antérieures à 7.2.13 (à venir)

References

Title

Publication Time

CERTFR-2026-AVI-0097

Vulnerability from certfr_avis - Published: 2026-01-28 - Updated: 2026-01-28

Une vulnérabilité a été découverte dans les produits Fortinet. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Fortinet indique que la vulnérabilité CVE-2026-24858 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur indique avoir désactivé l'authentification avec FortiCloud SSO pour les versions vulnérables. Des indicateurs de compromission sont disponibles dans l'avis éditeur.

Impacted products

Vendor	Product	Description
Fortinet	FortiManager	FortiManager versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiManager	FortiManager versions 7.0.x antérieures à 7.0.16 (à venir)
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.4.x antérieures à 7.4.10
Fortinet	FortiProxy	FortiProxy versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiOS	FortiOS versions 7.4.x antérieures à 7.4.11
Fortinet	FortiManager	FortiManager versions 7.4.x antérieures à 7.4.10
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiProxy	FortiProxy versions antérieures à 7.4.13 (à venir)
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.2.x antérieures à 7.2.12 (à venir)
Fortinet	FortiOS	FortiOS versions 7.6.x antérieures à 7.6.6 (à venir)
Fortinet	FortiAnalyzer	FortiAnalyzer versions 7.0.x antérieures à 7.0.16 (à venir)
Fortinet	FortiOS	FortiOS versions 7.0.x antérieures à 7.0.19 (à venir)
Fortinet	FortiOS	FortiOS versions 7.2.x antérieures à 7.2.13 (à venir)
Fortinet	FortiManager	FortiManager versions 7.2.x antérieures à 7.2.13 (à venir)

References

Title

Publication Time

BDU:2026-00882 (CVE-2026-24858)

Vulnerability from fstec – Published: 2026-01-28 – Updated: 2026-01-28 – View on bdu.fstec.ru Exploit exists Yes Fixed

CISA Shadowserver Previdian

Title

Уязвимость механизма аутентификации FortiCloud SSO операционных систем FortiOS, программного средства централизованного управления устройствами Fortinet FortiManager, программного средства отслеживания и анализа событий безопасности FortiAnalyzer и прокси-сервера для защиты от интернет-атак FortiProxy, позволяющая нарушителю получить несанкционированный доступ к устройству

Summary

Уязвимость механизма аутентификации FortiCloud SSO операционных систем FortiOS, программного средства централизованного управления устройствами Fortinet FortiManager, программного средства отслеживания и анализа событий безопасности FortiAnalyzer и прокси-сервера для защиты от интернет-атак FortiProxy связана с обходом аутентификации посредством использования альтернативного пути или канала. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к устройству

Severity

10.0 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 (Critical) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Authentication bypass

Incidents

Yes

Remediation

Software update

CWE

CWE-288 - Обход аутентификации посредством использования альтернативного пути или канала

Aliases

CVE-2026-24858, FG-IR-26-060

References

1 reference

URL
https://fortiguard.fortinet.com/psirt/FG-IR-26-060

Impacted products

4 products from 1 vendor

Vendors

Fortinet Inc.

Products

FortiProxy, FortiAnalyzer, FortiManager, FortiOS

Versions

7.2 (FortiProxy), 7.0 (FortiProxy), от 7.6.0 до 7.6.6 (FortiAnalyzer), от 7.4.0 до 7.4.10 (FortiAnalyzer), от 7.2.0 до 7.2.12 (FortiAnalyzer), от 7.0.0 до 7.0.16 (FortiAnalyzer), от 7.6.0 до 7.6.6 (FortiManager), от 7.4.0 до 7.4.10 (FortiManager), от 7.2.0 до 7.2.13 (FortiManager), от 7.0.0 до 7.0.16 (FortiManager), от 7.6.0 до 7.6.6 (FortiOS), от 7.4.0 до 7.4.11 (FortiOS), от 7.2.0 до 7.2.13 (FortiOS), от 7.0.0 до 7.0.19 (FortiOS), от 7.6.0 до 7.6.6 (FortiProxy), от 7.4.0 до 7.4.13 (FortiProxy)

Product types

Security device, Security software, ПО программно-аппаратных средств защиты, Application software, Operating system

Platforms

Fortinet Inc. FortiOS от 7.6.0 до 7.6.6, Fortinet Inc. FortiOS от 7.4.0 до 7.4.11, Fortinet Inc. FortiOS от 7.2.0 до 7.2.13, Fortinet Inc. FortiOS от 7.0.0 до 7.0.19

Mitigations

Установка обновлений из доверенных источников. В связи со сложившейся обстановкой и введенными санкциями против Российской Федерации рекомендуется устанавливать обновления программного обеспечения только после оценки всех сопутствующих рисков. Компенсирующие меры: - отключение механизма аутентификации FortiCloud SSO путем выполнения следующей команды (для FortiManager и FortiAnalyzer): config system saml set forticloud-sso disable end; или следующей команды (для FortiOS и FortiProxy): config system global set admin-forticloud-sso-login disable end; - использование средств межсетевого экранирования для ограничения удалённого доступа к уязвимому программному обеспечению; - сегментирование сети с целью ограничения доступа к уязвимому программному обеспечению из других подсетей; - использование систем обнаружения и предотвращения вторжений для отслеживания индикаторов - ограничение доступа из внешних сетей (Интернет). Использование рекомендаций: https://fortiguard.fortinet.com/psirt/FG-IR-26-060

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Fortinet Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.2 (FortiProxy), 7.0 (FortiProxy), \u043e\u0442 7.6.0 \u0434\u043e 7.6.6 (FortiAnalyzer), \u043e\u0442 7.4.0 \u0434\u043e 7.4.10 (FortiAnalyzer), \u043e\u0442 7.2.0 \u0434\u043e 7.2.12 (FortiAnalyzer), \u043e\u0442 7.0.0 \u0434\u043e 7.0.16 (FortiAnalyzer), \u043e\u0442 7.6.0 \u0434\u043e 7.6.6 (FortiManager), \u043e\u0442 7.4.0 \u0434\u043e 7.4.10 (FortiManager), \u043e\u0442 7.2.0 \u0434\u043e 7.2.13 (FortiManager), \u043e\u0442 7.0.0 \u0434\u043e 7.0.16 (FortiManager), \u043e\u0442 7.6.0 \u0434\u043e 7.6.6 (FortiOS), \u043e\u0442 7.4.0 \u0434\u043e 7.4.11 (FortiOS), \u043e\u0442 7.2.0 \u0434\u043e 7.2.13 (FortiOS), \u043e\u0442 7.0.0 \u0434\u043e 7.0.19 (FortiOS), \u043e\u0442 7.6.0 \u0434\u043e 7.6.6 (FortiProxy), \u043e\u0442 7.4.0 \u0434\u043e 7.4.13 (FortiProxy)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432. \u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043b\u043e\u0436\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0438 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0430\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u043e\u0446\u0435\u043d\u043a\u0438 \u0432\u0441\u0435\u0445 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 FortiCloud SSO \u043f\u0443\u0442\u0435\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b (\u0434\u043b\u044f FortiManager \u0438 FortiAnalyzer):\nconfig system saml\n    set forticloud-sso disable\nend;\n\n\u0438\u043b\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b (\u0434\u043b\u044f FortiOS \u0438 FortiProxy):\nconfig system global\n    set admin-forticloud-sso-login disable\nend;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0441 \u0446\u0435\u043b\u044c\u044e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e \u0438\u0437 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u0434\u0441\u0435\u0442\u0435\u0439;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442).\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://fortiguard.fortinet.com/psirt/FG-IR-26-060",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "27.01.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.01.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.01.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-00882",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2026-24858, FG-IR-26-060",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "FortiProxy, FortiAnalyzer, FortiManager, FortiOS",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Fortinet Inc. FortiOS \u043e\u0442 7.6.0 \u0434\u043e 7.6.6 , Fortinet Inc. FortiOS \u043e\u0442 7.4.0 \u0434\u043e 7.4.11 , Fortinet Inc. FortiOS \u043e\u0442 7.2.0 \u0434\u043e 7.2.13 , Fortinet Inc. FortiOS \u043e\u0442 7.0.0 \u0434\u043e 7.0.19 ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 FortiCloud SSO \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 Fortinet FortiManager, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 FortiAnalyzer \u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0438\u043b\u0438 \u043a\u0430\u043d\u0430\u043b\u0430 (CWE-288)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 FortiCloud SSO \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c FortiOS, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438 Fortinet FortiManager, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 FortiAnalyzer \u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u0430\u0442\u0430\u043a FortiProxy \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0438\u043b\u0438 \u043a\u0430\u043d\u0430\u043b\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0437\u0430\u0449\u0438\u0442\u044b, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-288",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 10)\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 9,8)"
}

FKIE_CVE-2026-24858

Vulnerability from fkie_nvd - Published: 2026-01-27 20:16 - Updated: 2026-06-17 10:23

CISA Shadowserver Previdian

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
psirt@fortinet.com	https://fortiguard.fortinet.com/psirt/FG-IR-26-060	Vendor Advisory
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	https://cert-portal.siemens.com/productcert/html/ssa-975644.html	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858	US Government Resource
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios	Mitigation, Vendor Advisory

Impacted products

Vendor	Product	Version
fortinet	fortianalyzer	*
fortinet	fortianalyzer	*
fortinet	fortianalyzer	*
fortinet	fortianalyzer	*
fortinet	fortimanager	*
fortinet	fortimanager	*
fortinet	fortimanager	*
fortinet	fortimanager	*
fortinet	fortinac-f	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiproxy	*
fortinet	fortiweb	*
fortinet	fortiweb	*
fortinet	fortiweb	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
fortinet	fortios	*
siemens	ruggedcom_ape1808_firmware	-
siemens	ruggedcom_ape1808	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiweb:8.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:8.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiweb:7.4.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiWeb",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "8.0.3",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.6.6",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.11",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FortiNAC-F",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortios:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.18:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.17:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiOS",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.10",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.12",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.18",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortianalyzer:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiAnalyzer",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.9",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.11",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiproxy:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.22:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.21:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.20:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiProxy",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.4",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.12",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.15",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.22",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:fortinet:fortimanager:7.6.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.6.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.15:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.14:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.12:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.11:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.10:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.9:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.8:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.7:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:o:fortinet:fortimanager:7.0.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiManager",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "7.6.5",
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.4.9",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.11",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@fortinet.com"
    },
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "RUGGEDCOM APE1808",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
    }
  ],
  "cisaActionDue": "2026-01-30",
  "cisaExploitAdd": "2026-01-27",
  "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2B61F1F-19A9-4BA6-B12A-ECA95C5634A3",
              "versionEndIncluding": "7.0.15",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D467D1D8-1BCF-4A88-8EEE-0D8092C3AE9C",
              "versionEndIncluding": "7.2.11",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BD96750D-104E-4DAE-A19E-8C92E85429F4",
              "versionEndExcluding": "7.4.10",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDF7BF56-B998-4AAE-9B6D-C6F009F8B807",
              "versionEndExcluding": "7.6.6",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "651E452B-3C1D-4738-BDFF-7234B19C63F7",
              "versionEndIncluding": "7.0.15",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D9D75F-B292-4651-8BF0-20AFE2C016C4",
              "versionEndIncluding": "7.2.11",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3AF70FA9-34D3-4ADF-B87C-A9C31D4DC174",
              "versionEndExcluding": "7.4.10",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "357DA889-E7C0-42B6-96A5-83C0D9E6CC69",
              "versionEndExcluding": "7.6.6",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortinac-f:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A43635C7-3F54-43F7-A193-A4C361685A43",
              "versionEndExcluding": "7.6.6",
              "versionStartIncluding": "7.6.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "63D22275-D430-4F99-9170-C8378FF80242",
              "versionEndIncluding": "7.0.22",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "33FE9C6F-F5A1-43E4-917E-32497D6CC5A6",
              "versionEndIncluding": "7.2.15",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA34D10C-0B80-4A37-94D2-CD05E865E149",
              "versionEndIncluding": "7.4.12",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A26D8D81-00EE-4A11-B693-DE85B912F267",
              "versionEndIncluding": "7.6.4",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "64C16483-DF84-43AA-B5D4-FA8939E4F387",
              "versionEndIncluding": "7.4.11",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B40750AD-AE67-42C3-89A5-E64F3D7F0431",
              "versionEndIncluding": "7.6.6",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EDCDD451-D984-4EC9-AB30-42D553FF0BD7",
              "versionEndIncluding": "8.0.3",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A0CDFB7-0B78-4B3E-9E19-34E5F2479271",
              "versionEndIncluding": "7.0.18",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "25DF0315-DF9C-4C51-9902-ED607B049152",
              "versionEndIncluding": "7.2.12",
              "versionStartIncluding": "7.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2ADAF67E-132B-4810-8919-38AC80BF59F5",
              "versionEndExcluding": "7.4.11",
              "versionStartIncluding": "7.4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "96C45B06-625A-4EFE-A720-242E33611B50",
              "versionEndExcluding": "7.6.6",
              "versionStartIncluding": "7.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "37FDCA69-9049-40B4-88AF-F476901022B6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B89A6863-B602-4404-8D26-337FECABFFF0",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n usando una ruta o canal alternativo [CWE-288] en Fortinet FortiAnalyzer 7.6.0 hasta 7.6.5, FortiAnalyzer 7.4.0 hasta 7.4.9, FortiAnalyzer 7.2.0 hasta 7.2.11, FortiAnalyzer 7.0.0 hasta 7.0.15, FortiManager 7.6.0 hasta 7.6.5, FortiManager 7.4.0 hasta 7.4.9, FortiManager 7.2.0 hasta 7.2.11, FortiManager 7.0.0 hasta 7.0.15, FortiOS 7.6.0 hasta 7.6.5, FortiOS 7.4.0 hasta 7.4.10, FortiOS 7.2.0 hasta 7.2.12, FortiOS 7.0.0 hasta 7.0.18, FortiProxy 7.6.0 hasta 7.6.4, FortiProxy 7.4.0 hasta 7.4.12, FortiProxy 7.2.0 hasta 7.2.15, FortiProxy 7.0.0 hasta 7.0.22, FortiWeb 8.0.0 hasta 8.0.3, FortiWeb 7.6.0 hasta 7.6.6, FortiWeb 7.4.0 hasta 7.4.11 puede permitir a un atacante con una cuenta de FortiCloud y un dispositivo registrado iniciar sesi\u00f3n en otros dispositivos registrados en otras cuentas, si la autenticaci\u00f3n SSO de FortiCloud est\u00e1 habilitada en esos dispositivos."
    }
  ],
  "id": "CVE-2026-24858",
  "lastModified": "2026-06-17T10:23:43.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "psirt@fortinet.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-24858",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-28T04:55:41.959755Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-27T20:16:24.477",
  "references": [
    {
      "source": "psirt@fortinet.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060"
    },
    {
      "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios"
    }
  ],
  "sourceIdentifier": "psirt@fortinet.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-288"
        }
      ],
      "source": "psirt@fortinet.com",
      "type": "Secondary"
    }
  ]
}

GHSA-2X38-48VP-W23X

Vulnerability from github – Published: 2026-01-27 21:31 – Updated: 2026-05-12 15:31

Details

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-24858"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-288"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-27T20:16:24Z",
    "severity": "CRITICAL"
  },
  "details": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.",
  "id": "GHSA-2x38-48vp-w23x",
  "modified": "2026-05-12T15:31:14Z",
  "published": "2026-01-27T21:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24858"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-975644.html"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-060"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858"
    },
    {
      "type": "WEB",
      "url": "https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

ICSA-26-071-02

Vulnerability from csaf_cisa - Published: 2026-03-10 00:00 - Updated: 2026-05-14 06:00

Summary

Siemens RUGGEDCOM APE1808 Devices

Scope

6 vulnerabilities in this advisory, including CVE-2026-24858.

CVE-2026-24858

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

NCSC-2026-0041

Vulnerability from csaf_ncscnl - Published: 2026-01-28 09:32 - Updated: 2026-01-28 09:32

Summary

Kwetsbaarheid verholpen in Fortinet producten

Scope

1 vulnerability in this advisory, including CVE-2026-24858.

CVE-2026-24858

A vulnerability in Fortinet's FortiAnalyzer, FortiManager, and FortiOS allows attackers with FortiCloud accounts to bypass authentication, leading to unauthorized access to registered devices when FortiCloud SSO is enabled.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

Known affected: 4 products

Open the full advisory

NCSC-2026-0079

Vulnerability from csaf_ncscnl - Published: 2026-03-10 12:39 - Updated: 2026-03-10 12:39

Summary

Kwetsbaarheden verholpen in Siemens producten

Scope

35 vulnerabilities in this advisory, including CVE-2026-24858.

CVE-2026-24858

Multiple Fortinet products including FortiAnalyzer, FortiManager, FortiOS, and FortiProxy have an authentication bypass vulnerability exploitable via FortiCloud SSO, allowing attackers with FortiCloud credentials to access other users' devices.

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C

Known affected: 126 products

Open the full advisory

SSA-975644

Vulnerability from csaf_siemens - Published: 2026-03-10 00:00 - Updated: 2026-05-12 00:00

Summary

SSA-975644: Multiple Vulnerabilities in Fortigate NGFW on RUGGEDCOM APE1808 Devices

Scope

6 vulnerabilities in this advisory, including CVE-2026-24858.

CVE-2026-24858

9.8 (Critical)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known affected: 1 product

Open the full advisory

WID-SEC-W-2026-0226

Vulnerability from csaf_certbund - Published: 2026-01-27 23:00 - Updated: 2026-01-27 23:00

Summary

Fortinet FortiAnalyzer, FortiManager, FortiOS und FortiProxy: Schwachstelle ermöglicht Erlangen von Administratorrechten

Severity

Kritisch

Scope

1 vulnerability in this advisory, including CVE-2026-24858.

CVE-2026-24858

Known affected: 14 products

Open the full advisory

Solutions

CNA · fortinet

Upgrade to upcoming FortiOS version 8.0.0 or above Upgrade to FortiOS version 7.6.6 or above Upgrade to FortiOS version 7.4.11 or above Upgrade to FortiOS version 7.2.13 or above Upgrade to FortiOS version 7.0.19 or above Upgrade to upcoming FortiManager version 8.0.0 or above Upgrade to FortiManager version 7.6.6 or above Upgrade to FortiManager version 7.4.10 or above Upgrade to FortiManager version 7.2.12 or above Upgrade to FortiManager version 7.0.16 or above Upgrade to FortiAnalyzer version 7.6.6 or above Upgrade to FortiAnalyzer version 7.4.10 or above Upgrade to FortiAnalyzer version 7.2.12 or above Upgrade to FortiAnalyzer version 7.0.16 or above Upgrade to FortiProxy version 7.6.5 or above Upgrade to FortiProxy version 7.4.13 or above Upgrade to FortiProxy version 7.2.16 or above Upgrade to FortiProxy version 7.0.23 or above Upgrade to FortiWeb version 8.0.4 or above Upgrade to FortiWeb version 7.6.7 or above Upgrade to FortiWeb version 7.4.12 or above Upgrade to FortiNAC-F version 7.6.6 or above Upgrade to FortiSwitchManager version 7.2.9 or above Upgrade to FortiSwitchManager version 7.0.8 or above

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-24858 (GCVE-0-2026-24858)

CISA

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Characteristics

Timestamps

Scope

Evidence

Honeypot In The Wild Attempts Confidence: 70% Source: shadowserver

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

Solutions

Solutions

BDU:2026-00882 (CVE-2026-24858)

Solutions

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour