9.8
CVE-2026-24858
- EPSS 85.84%
- Veröffentlicht 27.01.2026 19:18:23
- Zuletzt bearbeitet 09.06.2026 18:30:13
- Quelle psirt@fortinet.com
- CVE-Watchlists
- Unerledigt
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fortinet ≫ Fortianalyzer Version >= 7.0.0 <= 7.0.15
Fortinet ≫ Fortianalyzer Version >= 7.2.0 <= 7.2.11
Fortinet ≫ Fortianalyzer Version >= 7.4.0 < 7.4.10
Fortinet ≫ Fortianalyzer Version >= 7.6.0 < 7.6.6
Fortinet ≫ Fortimanager Version >= 7.0.0 <= 7.0.15
Fortinet ≫ Fortimanager Version >= 7.2.0 <= 7.2.11
Fortinet ≫ Fortimanager Version >= 7.4.0 < 7.4.10
Fortinet ≫ Fortimanager Version >= 7.6.0 < 7.6.6
Fortinet ≫ Fortinac-f Version >= 7.6.3 < 7.6.6
Fortinet ≫ FortiProxy Version >= 7.0.0 <= 7.0.22
Fortinet ≫ FortiProxy Version >= 7.2.0 <= 7.2.15
Fortinet ≫ FortiProxy Version >= 7.4.0 <= 7.4.12
Fortinet ≫ FortiProxy Version >= 7.6.0 <= 7.6.4
Siemens ≫ Ruggedcom Ape1808 Firmware Version-
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login27.01.2026: CISA Known Exploited Vulnerabilities (KEV) Catalog
Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
SchwachstelleFortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.
BeschreibungApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Erforderliche Maßnahmen| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 85.84% | 0.997 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| psirt@fortinet.com | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-288 Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://fortiguard.fortinet.com/psirt/FG-IR-26-060
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858
https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios
https://cert-portal.siemens.com/productcert/html/ssa-975644.html