# Fortinet follow-on SSO SAML bypass after the 59718 patch

Source: https://startwithidentity.com/cves/cve-2026-24858/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-24858 is the follow-on FortiCloud SSO [SAML](https://startwithidentity.com/glossary/saml/) bypass. Devices that had already taken the December 2025 patches for [CVE-2025-59718](https://startwithidentity.com/cves/cve-2025-59718/) and [CVE-2025-59719](https://startwithidentity.com/cves/cve-2025-59719/) were still exploitable. CISA published guidance on 28 January 2026. Exploitation is in the wild.

## Why it matters

This is the incomplete-fix pattern from ruby-saml, now on a firewall SSO plane that was already being exploited in December. "We patched FortiCloud SSO in December" is not a closed ticket. Attackers who burned 59718 simply moved to the leftover path.

## What to do

- Apply the January 2026 Fortinet builds that name CVE-2026-24858. Confirm the build string, not the calendar date of your last change window.
- Leave FortiCloud SSO off unless you have a reason to turn it back on.
- Re-hunt admin creation and config changes from late January 2026, even on boxes you thought were clean after December.

## After you patch

Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.

- **Revoke all sessions on the appliance**, then rotate the directory or [LDAP](https://startwithidentity.com/glossary/federation/) service account it uses for authentication.
- **Rotate certificates and any stored integration credentials**, since configuration stores on these devices are a routine post-exploitation target.
- **Hunt for authenticated sessions with no matching interactive login**, and for logins from ASNs that had never appeared before the disclosure date.
- **Check downstream**: anything the appliance could reach or authenticate to is in scope, including [SSO](https://startwithidentity.com/glossary/sso/)-connected applications.

## Sources

- [NVD: CVE-2026-24858](https://nvd.nist.gov/vuln/detail/CVE-2026-24858)
- CISA guidance, 28 January 2026