CVE-2026-24858

..... Allows an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts.....

https://fortiguard.fortinet.com/psirt/FG-IR-26-060

Fortinet hat ein Advisory zu einer neuen Schwachstelle CVE-2026-24858 in der FortiCloud-SSO-Implementierung veröffentlicht. Diese erlaubt es Angreifern mit einem FortiCloud-Konto und einem registrierten Gerät, sich bei anderen Geräten anzumelden, welche anderen Konten zugeordnet sind, sofern die FortiCloud-SSO-Authentifizierung auf diesen aktiviert wurde.
Patches sollten zeitnah installiert werden (sobald verfügbar). Das BSI hat entsprechend seinen Sicherheitshinweis aktualisiert.

‼️CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability

Severity: Critical
CVSS: 9.8
Zero Day: Yes
CVE Published: January 27th, 2026

Advisory: https://github.com/advisories/GHSA-2x38-48vp-w23x

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiOS ...

🔗 https://db.gcve.eu/vuln/cve-2026-24858

#fortinet #vulnerabilitymanagement #cybersecurity

CVE-2026-24858
An attacker with basic FortiCloud account and a registered device can log into other Fortinet devices. No, not their own devices. Devices registered to entirely different FortiCloud accounts.

Fortinet coupe le SSO en attendant les patchs pour la nouvelle faille zero-day : CVE-2026-24858 https://www.it-connect.fr/fortinet-coupe-le-sso-en-attendant-les-patchs-pour-la-nouvelle-faille-zero-day-cve-2026-24858/ #ActuCybersécurité #Cybersécurité #Vulnérabilité #Fortinet

Fortinet confirms active exploitation of FortiCloud SSO auth bypass (CVE-2026-24858, CVSS 9.4).
Cross-customer access via trusted SSO paths observed.

SSO now blocked for vulnerable versions - patching required.

https://www.technadu.com/fortinet-temporarily-disables-forticloud-sso-following-active-exploitation/619206/

#InfoSec #Fortinet #CVE #IdentitySecurity

Fortinet Confirms CVE-2026-24858 SSO Flaw Under Active Attack https://www.esecurityplanet.com/threats/fortinet-confirms-cve-2026-24858-sso-flaw-under-active-attack/

Here's a summary of recent important global, technology, and cybersecurity news:

Global: India has contained a Nipah virus outbreak (Jan 28, 2026). The EU approved a ban on Russian gas imports, effective from 2027 (Jan 27, 2026).

Technology: The EU is pressing Google to share AI and search data under new regulations (Jan 27, 2026). Samsung is nearing Nvidia approval for advanced HBM4 AI memory chips (Jan 27, 2026). Fujitsu developed AI for space weather prediction (Jan 28, 2026).

Cybersecurity: Microsoft issued emergency patches for an actively exploited Office zero-day vulnerability (CVE-2026-21509) (Jan 27, 2026). Fortinet patched a critical FortiOS SSO authentication bypass (CVE-2026-24858) under active exploitation (Jan 28, 2026). AI-powered polymorphic phishing attacks are also a growing concern (Jan 28, 2026).

#News #Anonymous #AnonNews_irc

Microsoft has rushed out an emergency security update for Office (CVE‑2026‑21509) after confirming the flaw is already being exploited in the wild. 🔐

The high‑severity security feature bypass lets attackers bypass OLE protections and run malicious code via specially crafted Office files. 📄⚠️

👉 Microsoft issues emergency fix for actively exploited Office flaw:
https://cyberinsider.com/microsoft-issues-emergency-fix-for-actively-exploited-office-flaw/
#Microsoft #Office #Security #CVE202621509 #PatchNow

Threre is also #OnlyOffice

https://www.onlyoffice.com/download-desktop

Here's a summary of recent important global, technology, and cybersecurity news:

Global: India has contained a Nipah virus outbreak (Jan 28, 2026). The EU approved a ban on Russian gas imports, effective from 2027 (Jan 27, 2026).

Technology: The EU is pressing Google to share AI and search data under new regulations (Jan 27, 2026). Samsung is nearing Nvidia approval for advanced HBM4 AI memory chips (Jan 27, 2026). Fujitsu developed AI for space weather prediction (Jan 28, 2026).

Cybersecurity: Microsoft issued emergency patches for an actively exploited Office zero-day vulnerability (CVE-2026-21509) (Jan 27, 2026). Fortinet patched a critical FortiOS SSO authentication bypass (CVE-2026-24858) under active exploitation (Jan 28, 2026). AI-powered polymorphic phishing attacks are also a growing concern (Jan 28, 2026).

#News #Anonymous #AnonNews_irc

WinRAR-Schwachstelle CVE-2025-8088: Staatsakteure und Cyberkriminelle nutzen Sicherheitslücke massiv aus

Bei CVE-2025-8088 handelt es sich um eine hochriskante Path-Traversal-Schwachstelle, die Angreifer durch Manipulation von Alternate Data Streams (ADS) ausnutzen können.

https://www.all-about-security.de/winrar-schwachstelle-cve-2025-8088-staatsakteure-und-cyberkriminelle-nutzen-sicherheitsluecke-massiv-aus/

#ads
#cve #WinRAR #cybersecurity

Yes, there's RCE in #OpenSSL 3.x, but thankfully it isn't in the HTTPS side of things:

"Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk."

https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467

Nearly 800,000 #Telnet servers exposed to remote attacks

The security flaw (CVE-2026-24061) already has a proof-of-concept exploit, impacts GNU InetUtils versions 1.9.3 (released in 2015) through 2.7, and was patched in version 2.8 (released on January 20).

https://www.bleepingcomputer.com/news/security/nearly-800-000-telnet-servers-exposed-to-remote-attacks/

🚨 Critical #Telnet Authentication Bypass Vulnerability Discovered #CVE202624061 #cybersecurity #infosec #DevOps #security

🔓 #GNU Inetutils telnetd through version 2.7 allows remote authentication bypass via "-f root" USER environment variable

⚡ The exploit is shockingly simple: attackers send "-f root" as the USER value, triggering /usr/bin/login -f root which skips password authentication entirely

🧵 👇

https://www.cve.org/CVERecord?id=CVE-2026-24061

#itsecurity #unix #linux #telnet #telnetd

✅ Immediate action required: Update to GNU Inetutils 2.8+ or migrate to #SSH for secure remote access

https://nvd.nist.gov/vuln/detail/CVE-2026-24061

🔴 CVE-2026-23830 - Critical (10)

SandboxJS is a JavaScript sandboxing library. Versions prior to 0.8.26 have a sandbox escape vulnerability due to `AsyncFunction` not being isolated in `SandboxFunction`. The library attempts to sandbox code execution by replacing the global `Func...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-23830/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

🔴 CVE-2025-40551 - Critical (9.8)

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without au...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-40551/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

Check Point Harmony Secure Access Service Edge Has A Critical Local Privilege Escalation Flaw

Researchers have uncovered a critical privilege-escalation vulnerability, in Check Point’s Harmony Secure Access Service Edge Windows client software, tracked as CVE-2025-9142, that enables hackers to write or delete files outside the certificate working directory that could compromise systems. More info can be here: Jim Routh, Chief Trust Officer at Saviynt, commented: “This…

https://itnerd.blog/2026/01/28/check-point-harmony-secure-access-service-edge-has-a-critical-local-privilege-escalation-flaw/

Odd WebLogic Request. Possible CVE-2026-21962 Exploit Attempt or AI Slop? #vulnerability #exploit #cve #ai https://isc.sans.edu/diary/rss/32662