CVE-2026-24858: fortinet fortianalyzer +6 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2026-24858

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 85,8%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada fortinet fortianalyzer, fortinet fortimanager +5 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut fortinet.com. Masuk katalog KEV CISA pada 27 Januari 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

Advisory KUTIM-CSIRT

Peringatan Keamanan: Kerentanan Kritis CVE-2026-24858 pada Fortinet FortiOS yang Dieksploitasi Secara Aktif 28 Jan 2026

Rincian

Terbit di NVD: 27 Januari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber fortinet.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-288: Authentication Bypass Using an Alternate Path or Channel
EPSS (30 hari): 85,8% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Masuk KEV: 27 Januari 2026
Tenggat CISA: 30 Januari 2026 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
fortinet	fortianalyzer	Versi 7.0.0 hingga 7.0.15
fortinet	fortianalyzer	Versi 7.2.0 hingga 7.2.11
fortinet	fortianalyzer	Versi 7.4.0 hingga sebelum 7.4.10
fortinet	fortianalyzer	Versi 7.6.0 hingga sebelum 7.6.6
fortinet	fortimanager	Versi 7.0.0 hingga 7.0.15
fortinet	fortimanager	Versi 7.2.0 hingga 7.2.11
fortinet	fortimanager	Versi 7.4.0 hingga sebelum 7.4.10
fortinet	fortimanager	Versi 7.6.0 hingga sebelum 7.6.6
fortinet	fortinac-f	Versi 7.6.3 hingga sebelum 7.6.6
fortinet	fortiproxy	Versi 7.0.0 hingga 7.0.22
fortinet	fortiproxy	Versi 7.2.0 hingga 7.2.15
fortinet	fortiproxy	Versi 7.4.0 hingga 7.4.12
fortinet	fortiproxy	Versi 7.6.0 hingga 7.6.4
fortinet	fortiweb	Versi 7.4.0 hingga 7.4.11
fortinet	fortiweb	Versi 7.6.0 hingga 7.6.6
fortinet	fortiweb	Versi 8.0.0 hingga 8.0.3
fortinet	fortios	Versi 7.0.0 hingga 7.0.18
fortinet	fortios	Versi 7.2.0 hingga 7.2.12
fortinet	fortios	Versi 7.4.0 hingga sebelum 7.4.11
fortinet	fortios	Versi 7.6.0 hingga sebelum 7.6.6
siemens	ruggedcom ape1808 firmware	Semua versi

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://fortiguard.fortinet.com/psirt/FG-IR-26-060 advisory vendor
https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios mitigasi · advisory vendor
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-24858 pemerintah AS
https://cert-portal.siemens.com/productcert/html/ssa-975644.html advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.