Alerts

Critical Fortinet Authentication Bypass Allows Access to Other Customers' Devices (CVE-2026-24858)

Zero Day Wire

— 2 min read
Critical Fortinet Authentication Bypass Allows Access to Other Customers' Devices (CVE-2026-24858)

Fortinet has disclosed a critical authentication bypass vulnerability affecting FortiOS, FortiManager, and FortiAnalyzer that allows attackers with a FortiCloud account to access devices registered to other customers' accounts. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.

The flaw, tracked as CVE-2026-24858, carries a CVSS severity score of 9.8 and affects organizations using FortiCloud single sign-on authentication across their Fortinet infrastructure.

Cross-Account Device Access

The vulnerability stems from an authentication bypass using an alternate path or channel weakness. An attacker who possesses a valid FortiCloud account and at least one registered device can exploit the flaw to log into devices registered to entirely different accounts, provided those target devices have FortiCloud SSO authentication enabled.

This cross-tenant access vulnerability is particularly severe because it breaks the fundamental isolation between customer environments. Attackers do not need credentials for the target organization — only their own valid FortiCloud account and a registered device to initiate the attack.

Extensive Product Impact

The vulnerability affects multiple versions across three major Fortinet product lines:

FortiAnalyzer versions 7.6.0 through 7.6.5, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.15 are affected.

FortiManager versions 7.6.0 through 7.6.5, 7.4.0 through 7.4.9, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.15 are affected.

FortiOS versions 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.12, and 7.0.0 through 7.0.18 are affected.

The broad version coverage spanning multiple major releases indicates the vulnerability has existed in Fortinet's codebase for an extended period.

Active Exploitation Confirmed

CISA's addition of CVE-2026-24858 to the Known Exploited Vulnerabilities catalog confirms the flaw is being actively exploited by threat actors. Federal agencies are required to apply mitigations according to CISA's binding operational directive timelines.

Fortinet has published technical analysis of the SSO abuse mechanism on its PSIRT blog, providing additional details on how attackers are leveraging the vulnerability.

Immediate Action Required

Organizations using FortiCloud SSO authentication should apply patches immediately. Given the critical severity rating and confirmed active exploitation, this vulnerability should be treated as a priority remediation item.

As a temporary mitigation, organizations unable to patch immediately should consider disabling FortiCloud SSO authentication until updates can be applied. Security teams should review logs for any unauthorized access attempts that may indicate prior exploitation.

Organizations should also audit which devices have FortiCloud SSO enabled and verify that no unauthorized access has occurred to their Fortinet infrastructure.

Read more

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

By Zero Day Wire
ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors

By Zero Day Wire