Advisory
H-ISAC TLP White Active Exploitations of an Authentication Bypass Vulnerability
H-ISAC TLP White Bulletin: Active Exploitations of an Authentication Bypass Vulnerability on Administrative FortiCloud SSO
On January 15, 2026, a critical authentication bypass vulnerability, tracked as CVE-2026-24858, in FortiCloud SSO was discovered. It allows unauthenticated remote attackers to gain administrative access to Fortinet devices.
Recently, the vulnerability has been observed being actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog on January 27, 2026.
Healthcare organizations must patch immediately or disable FortiCloud SSO to prevent unauthorized network entry and potential patient data breaches.
Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their level of risk from this vulnerability.
View the detailed bulletin below.
For help with Cybersecurity and Risk Advisory Services exclusively for AHA members, contact:
John Riggi
National Advisor for Cybersecurity and Risk, AHA
jriggi@aha.org
(O) +1 202 626 2272
Key Resources
Related Resources
Letter/Comment