Fortinet Multiple Products Authentication Bypass via Alternate Path or Channel (CVE-2026-24858)

let timeframe = 24h;
let SuspiciousFortinetAuth = CommonSecurityLog
| where TimeGenerated >= ago(timeframe)
| where DeviceVendor =~ "Fortinet"
| where Activity has_any ("sso", "saml", "oauth", "authentication", "login", "bypass")
| where (AdditionalExtensions has_any ("auth_method=sso", "auth_method=saml", "bypass", "alternate") or Message has_any ("SSO", "SAML", "alternate path", "auth bypass", "unauthenticated"))
| extend SourceIP = coalesce(SourceIP, DeviceAddress)
| project TimeGenerated, DeviceName, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, Activity, Message, AdditionalExtensions, LogSeverity;
let AdminActions = CommonSecurityLog
| where TimeGenerated >= ago(timeframe)
| where DeviceVendor =~ "Fortinet"
| where Activity has_any ("admin", "config", "privilege", "root", "super_admin")
| where LogSeverity in ("high", "critical", "error")
| extend SourceIP = coalesce(SourceIP, DeviceAddress)
| project TimeGenerated, DeviceName, SourceIP, Activity, Message, LogSeverity;
SuspiciousFortinetAuth
| join kind=leftouter AdminActions on $left.SourceIP == $right.SourceIP
| summarize AuthEvents=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Activities=make_set(Activity), Messages=make_set(Message) by DeviceName, DeviceVendor, DeviceProduct, SourceIP
| where AuthEvents >= 1
| extend RiskScore = case(AuthEvents > 10, "High", AuthEvents > 3, "Medium", "Low")
| project FirstSeen, LastSeen, DeviceName, DeviceProduct, SourceIP, AuthEvents, Activities, Messages, RiskScore
| sort by AuthEvents desc

index=firewall OR index=network OR index=fortinet sourcetype IN ("fortigate_utm", "fortinet:fortigate:firewall", "fgt_log")
| where vendor="Fortinet" OR source_vendor="Fortinet"
| eval auth_bypass_indicator=if(match(lower(coalesce(msg, message, log_message, "")), "sso|saml|alternate.path|auth.bypass|unauthenticated|bypass|oauth"), 1, 0)
| eval admin_action=if(match(lower(coalesce(msg, message, log_message, "")), "admin|config.change|super.admin|privilege|root.access"), 1, 0)
| eval suspicious=if(auth_bypass_indicator=1 AND (action="accept" OR action="allowed" OR action="login"), 1, 0)
| where suspicious=1 OR (auth_bypass_indicator=1 AND admin_action=1)
| stats count AS event_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(msg) AS messages, values(action) AS actions, values(dstip) AS destination_ips by src_ip, hostname, devname
| eval risk_score=case(event_count>10, "high", event_count>3, "medium", true(), "low")
| where event_count >= 1
| sort - event_count
| table first_seen, last_seen, hostname, devname, src_ip, destination_ips, event_count, risk_score, actions, messages

sequence by source.ip, host.name with maxspan=30m
  [network where event.category == "network" and
   (network.application in ("forticlient", "fortios", "fortigate") or
    observer.vendor == "Fortinet") and
   (message like~ "*sso*" or message like~ "*saml*" or message like~ "*alternate*auth*" or
    message like~ "*bypass*" or message like~ "*unauthenticated*") and
   event.outcome == "success"]
  [authentication where event.category == "authentication" and
   (observer.vendor == "Fortinet" or host.type == "firewall") and
   event.outcome == "success" and
   (user.name like~ "*admin*" or user.roles like~ "*super*" or user.roles like~ "*root*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  username,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  UTF8(payload) AS raw_payload,
  category,
  severity
FROM events
WHERE
  logsourcetypename(devicetype) ILIKE '%fortinet%'
  OR logsourcetypename(devicetype) ILIKE '%fortigate%'
AND (
  LOWER(UTF8(payload)) ILIKE '%sso%'
  OR LOWER(UTF8(payload)) ILIKE '%saml%'
  OR LOWER(UTF8(payload)) ILIKE '%alternate%path%'
  OR LOWER(UTF8(payload)) ILIKE '%auth%bypass%'
  OR LOWER(UTF8(payload)) ILIKE '%unauthenticated%access%'
)
AND eventdirection = 'L2R'
AND LOWER(UTF8(payload)) NOT ILIKE '%failed%'
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=fortinet OR _sourceCategory=fortigate OR _sourceName=*forti*
| where vendor matches /(?i)fortinet/ or _raw matches /(?i)(fortigate|fortios|forticlient)/
| where _raw matches /(?i)(sso|saml|alternate.path|auth.bypass|unauthenticated|bypass.auth)/
| parse "action=*" as action nodrop
| parse "srcip=*" as src_ip nodrop
| parse "dstip=*" as dst_ip nodrop
| parse "user=*" as username nodrop
| parse "msg=*" as message nodrop
| where action matches /(?i)(accept|allow|login|success|permit)/ or isNull(action)
| count as event_count by src_ip, username, action, _sourceHost
| where event_count >= 1
| sort by event_count desc
| fields _sourceHost, src_ip, username, action, event_count

rule fortinet_auth_bypass_cve_2026_24858 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects Fortinet authentication bypass via alternate path/SSO abuse (CVE-2026-24858)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://fortiguard.fortinet.com/psirt/FG-IR-26-060"
    cve = "CVE-2026-24858"

  events:
    $e.metadata.event_type = "NETWORK_CONNECTION"
    (
      $e.network.application_protocol = "HTTPS" or
      $e.network.application_protocol = "HTTP"
    )
    (
      $e.target.asset.hostname /(?i)forti/ or
      $e.observer.hostname /(?i)forti/ or
      $e.target.application /(?i)fortinet/
    )
    (
      $e.metadata.description /(?i)(sso|saml|alternate.path|auth.bypass|unauthenticated)/ or
      $e.network.http.request_url /(?i)(sso|saml|bypass|alternate)/
    )
    $e.security_result.action = "ALLOW"

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6 OR #event_simpleName=UserLogon
| TargetFileName=/forti/i OR RemoteAddress=* AND (CommandLine=/sso/i OR CommandLine=/saml/i OR CommandLine=/bypass/i)
| eval auth_bypass=if(match(coalesce(CommandLine, ""), /(?i)(sso|saml|alternate.path|auth.bypass|unauthenticated)/), "true", "false")
| where auth_bypass="true"
| groupby([RemoteAddress, UserName, ComputerName, CommandLine], function=count(aid, as=event_count))
| sort(event_count, order=desc)
| head(100)