Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.4 .8580 99.7 YES
AFFECTED Product Versions Fixed FortiWeb 8.0.0 – — FortiNAC-F 7.6.3 – — FortiOS 7.6.0 – — FortiAnalyzer 7.6.0 – — FortiProxy 7.6.0 – — FortiManager 7.6.0 – —
TIMELINE Jan 27 Added to CISA KEV, remediation due 2026-01-30 Jan 27 Reserved by fortinet Jan 27 Published (CNA: fortinet)
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
| Date | Event | Detail |
|---|---|---|
| January 27, 2026 | KEV ADDED | Added to CISA KEV, remediation due 2026-01-30 |
| January 27, 2026 | Reserved | Reserved by fortinet |
| January 27, 2026 | Published | Published (CNA: fortinet) |
Authoritative record: CVE-2026-24858 at cve.org
Vendors: fortinet
Weaknesses: CWE-288
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-24858 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
