CVE-2025-59718-PoC

CVE-2025-59718 Exploit Wizard Overview This tool is a proof-of-concept PoC exploit script for CVE-2025-59718, a critical authentication bypass vulnerability in Fortinet products e.g., FortiOS, FortiProxy, FortiSwitchManager due to improper verification of cryptographic signatures in SAML messages...

CVE-2026-24858

CVE-2026-24858 漏洞分析报告（含来源完整版） Fortinet FortiCloud SSO 认证绕过漏洞（Authentication Bypass） 文档版本 ：2.0（来源完整标注版） 最后更新 ：2026年1月29日 编写目的 ：安全审计、技术文档化、事件响应 📋 目录 1. 概述及基本信息 2. 漏洞机制详细分析 3. 受影响产品及版本 4. CVSS 评分及严重性评估 5. 实际攻击场景及活动 6. 检测及取证指标（IOCs） 7. 即时响应措施 8. 安全加固建议 9. 参考资料及来源 📋 概述及基本信息 1.1 漏洞摘要 CVE-2026-24858 是...

cve-2026-24858

CVE-2026-24858 PoC 辅助工具 CVE-2026-24858 - 管理端 FortiCloud SSO 认证绕过 此仓库包含一个保守的 Python 辅助工具，用于 扫描 Fortinet Web 管理指标，并可选（显式）发送载荷。漏洞利用/载荷发送功能默认禁用，需要显式标志才能运行。 使用示例： 安装依赖： root@kitploit: python3 -m pip install -r requirements.txt 扫描目标（默认 HTTPS 端口 443）： root@kitploit: python3 cve202624858tool.py scan...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO 认证绕过 执行摘要 FortiCloud 单点登录（SSO）是注册任何 FortiGate/FortiManager/FortiAnalyzer 后默认启用的功能，其中包含一个严重的认证绕过漏洞。 任何拥有 FortiCloud 账户（免费或付费）的攻击者都可以复用其 SSO 令牌登录其他客户的设备（版本不高于下表所列），而无需知道对方的密码。 利用成功后，攻击者可获得完整的 admin GUI 和 root shell 访问权限，从而能够拦截流量、篡改 VPN 或横向移动进入内部网络。 请立即升级，或在修复前禁用...

SCTT-2026-33-0004-FortiCloud-SSO-Identity-Singularity

SCTT-2026-33-0004：FortiCloud SSO 身份奇点 这是 SCTT-0004 向量的完整实现。 📡 技术分析 虽然 Fortinet 于 2026 年 1 月 27 日针对 CVE-2026-24858 的缓解措施侧重于阻止 [email protected] 等特定账户，但它未能解决 SAML 状态机的时间漏洞 。 通过使用 $\alpha = 0.0302011$ 常量 ，我们将一个低权限访客账户与主 SSO 会话表同步。在第 33 个脉冲时，负载均衡器会经历一次相变 ，使访客能够继承下一个可用管理员登录的会话权限。 🚀 使用方法 1. 获取一个有效...

Siemens APE1808 Authentication Bypass Using an Alternate Path or Channel (CVE-2026-24858)

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager...

Fortinet FortiWeb SSO authentication bypass (FG-IR-26-060)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-060 advisory. - An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 in FortiOS, FortiManager, FortiAnalyzer ma...

CVE-2026-24858

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager...

Vulnerabilities fixed in Fortinet products

Fortinet has fixed vulnerabilities in FortiOS, FortiProxy, FortiWeb and FortiSwitchManager. The vulnerabilities allow unauthenticated attackers to gain access to systems by using various techniques, including bypassing FortiCloud SSO login authentication via specially crafted SAML messages,...

Fortinet Releases Guidance to Address Ongoing Exploitation of Authentication Bypass Vulnerability CVE-2026-24858

Newly disclosed vulnerability Common Vulnerabilities and Exposures CVE-2026-24858link is external Common Weakness Enumeration CWE-288: Authentication Bypass Using an Alternate Path or Channellink is external allows malicious actors with a FortiCloud account and a registered device to log in to...

Vulnerability fixed in Fortinet products

Fortinet has fixed a vulnerability in FortiAnalyzer, FortiManager, FortiOS and FortiProxy products. The vulnerability is in specific implementations of FortiCloud SSO authentication. The vulnerability allows attackers with a registered device and a FortiCloud account to bypass authentication and...

Fortinet Patches CVE-2026-24858 After Active FortiOS SSO Exploitation Detected

Fortinet has begun releasing security updates to address a critical flaw impacting FortiOS that has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2026-24858 CVSS score: 9.4, has been described as an authentication bypass related to FortiOS single...

The vulnerability of the FortiCloud SSO authentication mechanism affects operating systems based on FortiOS, the Fortinet FortiManager device management software, the FortiAnalyzer event monitoring and analysis software, and the FortiProxy proxy server used for protecting against internet attacks. This vulnerability allows a perpetrator to gain unauthorized access to the device.

The vulnerability of the FortiCloud SSO authentication mechanism affects operating systems based on FortiOS, the Fortinet FortiManager device management software, the FortiAnalyzer event monitoring and analysis software, and the FortiProxy proxy server used for protecting against internet attacks...

Fortinet FortiAnalyzer SSO authentication bypass (FG-IR-26-060)

The version of FortiAnalyzer installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-060 advisory. - An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 in FortiOS, FortiManager, FortiAnalyz...

Fortinet FortiManager SSO authentication bypass (FG-IR-26-060)

The version of FortiManager installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-060 advisory. - An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 in FortiOS, FortiManager, FortiAnalyze...

Fortinet Fortigate SSO authentication bypass (FG-IR-26-060)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-26-060 advisory. - An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 in FortiOS, FortiManager, FortiAnalyzer m...

CVE-2026-24858

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager...

CVE-2026-24858

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager...

CVE-2026-24858

CVE-2026-24858 is a high-severity authentication bypass affecting Fortinet FortiAnalyzer, FortiManager, FortiOS, FortiProxy, and FortiWeb (various 7.x versions) via FortiCloud SSO. The issue allows an attacker with a FortiCloud account and a registered device to log into other devices registered ...

CVE-2026-24858

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager...