U.S. CISA adds a flaw in multiple Fortinet products to its Known Exploited Vulnerabilities catalog

CISA added a critical Fortinet authentication-bypass vulnerability (CVE-2026-24858, CVSS 9.4) affecting FortiOS, FortiManager, and FortiAnalyzer to its Known Exploited Vulnerabilities catalog after evidence of active exploitation by malicious FortiCloud accounts; Fortinet rolled out patches, disabled and later re-enabled FortiCloud SSO with mitigations, and federal agencies were ordered to remediate by January 30, 2026.