CISA Warns of FortiCloud SSO Authentication Bypass Vulnerability Exploited in Attacks

**Executive Summary:** CVE-2026-24858 is a critical (CVSS 9.1) authentication bypass in FortiCloud SSO affecting FortiAnalyzer, FortiManager, FortiOS, and FortiProxy; CISA has added it to the Known Exploited Vulnerabilities catalog after reports of active abuse. Attackers can register low‑privilege devices to capture and replay SSO tokens to gain administrative access for lateral movement and ransomware staging; Fortinet has published fixes and recommends disabling FortiCloud SSO, enforcing MFA, and monitoring for anomalous logins.