FG-IR-26-060: Administrative FortiCloud SSO authentication bypass
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiSwitchManager, FortiWeb may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.Please note that the FortiCloud SSO login feature is not enabled in default factory settings. However, when an administrator registers the device to FortiCare from the device's GUI, unless the administrator disables the toggle switch "Allow administrative login using FortiCloud SSO" in the registration page, FortiCloud SSO login is enabled upon registration. This vulnerability was found being exploited in the wild by two malicious FortiCloud accounts, which were locked out on 2026-01-22. In order to protect its customers from further exploit, Fortinet disabled FortiCloud SSO on FortiCloud side on 2026-01-26. It was re-enabled on 2026-01-27 and no longer supports login from devices running vulnerable versions. Consequently, customers must upgrade to the latest versions listed below for the FortiCloud SSO authentication to function.FortiManager Cloud, FortiAnalyzer Cloud, FortiGate Cloud are NOT impacted.Setups with Custom IdP for SSO instead of FortiCloud are not impacted (including setups using FortiAuthenticator as the Custom IdP)
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-26-060?
FG-IR-26-060 is considered a critical vulnerability as it involves an authentication bypass allowing unauthorized access.
How do I fix FG-IR-26-060?
To fix FG-IR-26-060, upgrade your FortiOS, FortiManager, FortiAnalyzer, or FortiProxy to the latest patched version as recommended by Fortinet.
Which products are affected by FG-IR-26-060?
FG-IR-26-060 affects multiple products including FortiOS, FortiManager, FortiAnalyzer, and FortiProxy across specific versions.
Can FG-IR-26-060 be exploited remotely?
Yes, FG-IR-26-060 can be exploited remotely if an attacker has a valid FortiCloud account and a registered device.
What is an authentication bypass in FG-IR-26-060?
An authentication bypass in FG-IR-26-060 refers to the ability for attackers to gain access to devices without proper credentials by using an alternate path.