Two Fortinet events of 2026: what to check

This report details two Fortinet incidents in 2026: a FortiCloud SSO authentication flaw (CVE-2026-24858) that allowed cross-account device logins and was exploited in January, and a June credential-stuffing/brute-force campaign (FortiBleed) that leveraged leaked or weak credentials to access internet-exposed FortiGate and VPN portals, impacting many devices; it compiles advisories from Fortinet, CISA, NCSC and others and lists prioritized checks (SSO status, internet admin exposure, session termination and password rotation, admin account inventory, MFA enforcement, and log review) plus recommendations such as isolating compromised devices and factory resets when persistence is suspected.