Identity CVE · SAML
CVE-2026-24858Fortinet follow-on SSO SAML bypass after the 59718 patch
criticalCISA KEVActively exploited
Product: Fortinet products (FortiCloud SSO)Vendor: FortinetCWE-347Disclosed: 2026-01-28Status: Actively exploitedProtocol deep diveNVD ↗CISA KEV ↗
What broke
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices that had already taken the December 2025 patches for CVE-2025-59718 and CVE-2025-59719 were still exploitable. CISA published guidance on 28 January 2026. Exploitation is in the wild.
Why it matters
This is the incomplete-fix pattern from ruby-saml, now on a firewall SSO plane that was already being exploited in December. "We patched FortiCloud SSO in December" is not a closed ticket. Attackers who burned 59718 simply moved to the leftover path.
What to do
- Apply the January 2026 Fortinet builds that name CVE-2026-24858. Confirm the build string, not the calendar date of your last change window.
- Leave FortiCloud SSO off unless you have a reason to turn it back on.
- Re-hunt admin creation and config changes from late January 2026, even on boxes you thought were clean after December.
Sources
- NVD: CVE-2026-24858
- CISA guidance, 28 January 2026
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.