Fortinet · Multiple Products
CVE-2026-24858
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
O que é
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
CISA: Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
O que fazer
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 30 de janeiro de 2026
- Adicionada à lista da CISA
- 27 de janeiro de 2026
- Publicada
- 27 de janeiro de 2026
- Gravidade
- Crítica 9,4 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 87% entre os 0,3% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-288
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (1)
Mais falhas exploradas de Fortinet
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 16 de out. de 2026 | Path Traversal | Multiple Products | Média 5,4 | 1,3% |
| 9 de set. de 2026 | Heap-based Buffer Overflow | Multiple Products | Alto 7,4 | 3,7% |
| 16 de dez. de 2025 | Improper Verification of Cryptographic Signature | Multiple Products | Crítica 9,1 | 68% |
| 14 de mai. de 2025 | Stack-Based Buffer Overflow | Multiple Products | Crítica 9,6 | 31% |
| 9 de out. de 2024 | Format String | Multiple Products | Crítica 9,8 | 62% |
| 11 de out. de 2022 | Authentication Bypass | Multiple Products | Crítica 9,8 | >99,9% |
| 1 de out. de 2026 | Path Traversal | FortiMail | Crítica 9,8 | 4,6% |
| 27 de jul. de 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Média 5,3 | 29% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.