CVE-2026-24858: FortiCloud SSO Authentication Bypass Vulnerability Exploited

**Executive Summary:** On January 27, 2026 Fortinet disclosed CVE-2026-24858, a critical FortiCloud SSO authentication bypass affecting FortiOS, FortiAnalyzer, FortiManager, and FortiProxy; threat actors with a FortiCloud account and a registered device could authenticate to other registered devices, create local administrative accounts for persistence, and exfiltrate configuration data. Arctic Wolf observed related active exploitation and recommends upgrading to fixed product versions, restricting management interface access, enabling comprehensive log monitoring, and restoring clean firmware/configurations if compromise is suspected.