Week of January 26, 2026: Fortinet SSO Bypass Under Active Attack, CISA Expands KEV Catalog

The week of January 26, 2026 was dominated by Fortinet's FortiCloud single sign-on authentication bypass, CVE-2026-24858, which let attackers log into FortiGate and other Fortinet devices even after earlier SAML patches, prompting a same-week CISA Known Exploited Vulnerabilities Catalog addition alongside separate listings for Ivanti Endpoint Manager Mobile and five other actively exploited flaws. CISA also pushed critical infrastructure operators toward multi-disciplinary insider threat programs, while ConductorOne, Okta, and Dragos filled senior security and product leadership seats.

CISA Flags Actively Exploited Ivanti EPMM Flaw

On January 29, 2026, CISA added CVE-2026-1281, a code injection vulnerability in Ivanti Endpoint Manager Mobile, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The listing triggered Binding Operational Directive 22-01 remediation timelines for federal civilian agencies running the mobile device management product, and CISA again urged all organizations, not just the federal enterprise, to prioritize patching cataloged flaws given their continued use by threat actors seeking footholds on exposed endpoint management infrastructure. (CISA)

Fortinet SSO Bypass Hit FortiGate Firewalls With Live Attacks

Fortinet and CISA disclosed that CVE-2026-24858, an authentication bypass in FortiCloud single sign-on, let attackers holding a FortiCloud account log into other customers' FortiOS, FortiManager, FortiWeb, FortiProxy and FortiAnalyzer devices. CISA said that even fully patched devices addressing earlier SAML bypass flaws CVE-2025-59718 and CVE-2025-59719 remained vulnerable, and that Fortinet observed unauthorized firewall configuration changes, new account creation, and VPN changes granting attacker access. Fortinet disabled FortiCloud SSO on January 26, 2026, and reinstated it on January 27, 2026 with additional protections. (CISA)

CISA Adds Fortinet Authentication Bypass to KEV Catalog

On January 27, 2026, CISA added CVE-2026-24858, an authentication bypass affecting multiple Fortinet products, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The addition covered FortiOS, FortiManager, FortiWeb, FortiProxy, and FortiAnalyzer deployments using FortiCloud single sign-on, and set a federal remediation deadline under Binding Operational Directive 22-01. CISA urged all organizations operating the affected Fortinet products to check for compromise indicators and apply vendor updates without delay, given the vulnerability's frequent use as an attack vector. (CISA)

CISA Catalogs Five More Actively Exploited Flaws

On January 26, 2026, CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a Linux kernel integer overflow bug dating to 2018, two SmarterTools SmarterMail flaws covering unrestricted file upload and authentication bypass, a Microsoft Office security feature bypass, and a GNU InetUtils argument injection issue. The additions set remediation deadlines for federal civilian agencies under Binding Operational Directive 22-01 and reinforced CISA's broader call for all organizations to prioritize patching cataloged vulnerabilities in their own environments. (CISA)

CISA Pushes Critical Infrastructure on Insider Threat Programs

CISA released new guidance on January 28, 2026 urging critical infrastructure organizations and state, local, tribal, and territorial governments to build multi-disciplinary insider threat management teams. The infographic, Assembling a Multi-Disciplinary Insider Threat Management Team, addressed both malicious insider activity and unintentional employee errors as risks to operations and trust. Acting CISA Director Dr. Madhu Gottumukkala and Executive Assistant Director for Infrastructure Security Steve Casapulla both framed insider threat programs as essential rather than optional for organizational resilience. (CISA)

ConductorOne Hires Netflix, Capital One Veteran as CISO

Identity security vendor ConductorOne named William Bengtson as chief information security officer for the week of January 26, 2026, tasking him with leading its security strategy after prior leadership roles at HashiCorp, Netflix, Capital One, and Nuna. The same industry moves roundup noted Okta hired Ely Kahn, formerly chief product officer at SentinelOne, as its own chief product officer, and Dragos appointed Dawn Mitchell, previously chief people officer at HackerOne, to the same role. (SecurityWeek)