cve recordhighexploited in the wild

CVE-2026-24858

Fortinet · Multiple Products · Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

· Added to CISA KEV Jan 27, 2026

CVSS—

Severityhigh

Weakness—

ExploitedYes, in CISA KEV

Ransomware useUnknown

Federal fix dueJan 30, 2026

Description

Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Required action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-24858

CVE-2026-15409Aug 26, 2026critical

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

A joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs reveals that both state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Special thanks to SentinelOne® Incident Readiness & Response for their contributions to this publication. It is the shared attack surface where state-sponsored threat actors and financially motivated criminal grou

CVE-2026-24858Jul 8, 2026high

FortiBleed: Credential Reuse, Legacy Hashes, and the Risk of Internet-Exposed FortiGate Devices

A widespread issue dubbed FortiBleed has been reported, involving the large-scale exposure and abuse of credentials targeting internet-facing FortiGate devices. This problem stems from credential reuse and brute-force attacks, rather than a new vulnerability. The risk is particularly high for devices lacking multi-factor authentication or those with previously compromised credentials.