Authentication Under Siege: Fortinet SSO Exploited as Microsoft Retreats on SMTP Deprecation

The foundational layers of enterprise security—authentication and access control—are showing alarming cracks from two opposing directions. On one front, a critical vulnerability in a modern Single Sign-On (SSO) solution is being actively exploited, compromising the very systems designed to streamline and secure access. On another, the retirement of a decades-old, fundamentally insecure protocol is being delayed, exposing organizations to prolonged risk. This dual crisis underscores the fragile state of identity management in today's digital ecosystem.

Fortinet's Critical SSO Flaw: CVE-2026-24858 in Active Exploitation

Fortinet, a major player in network security, is currently contending with active, real-world attacks targeting a severe vulnerability in its FortiOS software. Tracked as CVE-2026-24858, this flaw resides within the FortiOS SSO administrator portal. The vulnerability is particularly dangerous because it can be triggered by an unauthenticated attacker, requiring no prior access or credentials. Successful exploitation allows the execution of arbitrary code or commands on the underlying system, potentially granting an attacker full control over the Fortinet device.

The SSO administrator portal is a high-value target. Compromising it could allow threat actors to manipulate single sign-on policies, create backdoor user accounts, or pivot to other connected systems within an organization's network. Fortinet has released patches and security advisories urging immediate action. However, the confirmation of active exploitation in the wild means that any delay in applying these patches carries significant risk. Security teams managing Fortinet appliances must treat this with the highest priority, verifying their versions and applying updates without delay. This incident serves as a stark reminder that even security-focused platforms that manage critical authentication functions are not immune to devastating bugs.

Microsoft's SMTP Retreat: The Legacy Protocol That Won't Die

In a parallel but related struggle, Microsoft has announced a substantial revision to its plan for deprecating SMTP AUTH with Basic Authentication in Exchange Online. The original timeline, which called for disabling the protocol by late 2024, has been pushed back. The new final deadline is now December 2025, representing a nearly year-long retreat.

SMTP (Simple Mail Transfer Protocol) AUTH with Basic Authentication is a legacy method for submitting emails to Exchange Online. It is notoriously insecure, as it typically transmits usernames and passwords in clear text or with easily reversible encoding, making it highly susceptible to credential theft and replay attacks. Microsoft has long advocated for its replacement with modern authentication (OAuth 2.0), which provides token-based, encrypted authentication without sending passwords directly.

The delay is a pragmatic admission of the massive migration challenge. Countless legacy applications, multifunction printers, scanners, and line-of-business software still rely on the old SMTP AUTH method. For many organizations, identifying and updating or replacing these systems is a complex, time-consuming, and costly endeavor. Microsoft's extension provides crucial breathing room but also extends the window of vulnerability. Organizations must use this extra time strategically, not as an excuse for inaction. The continued use of Basic Authentication for SMTP remains a glaring weak spot in an organization's security posture, often exploited in phishing campaigns and credential-stuffing attacks.

The Authentication Patchwork: Systemic Risk and Strategic Imperatives

These two stories, though different in nature, are threads of the same fabric: the enterprise authentication patchwork. They reveal a security landscape caught between the bleeding edge and the rusty past.

The Fortinet exploit demonstrates that modern, consolidated authentication gateways (SSO) are complex systems that, when compromised, offer attackers a master key. Conversely, Microsoft's SMTP dilemma highlights the immense inertia of legacy technology. Insecure protocols become deeply embedded in business processes, and their removal is often a logistical and financial nightmare.

This creates a perfect storm for defenders. They must urgently patch and defend sophisticated new systems while simultaneously orchestrating the retirement of ancient, vulnerable ones—all while under constant attack. The operational burden is immense.

Actionable Guidance for Security Teams

1. Fortinet Administrators: Immediately review all FortiOS instances, especially those with the SSO feature enabled. Apply the relevant patches for CVE-2026-24858 as a critical priority. Monitor authentication logs for any suspicious activity targeting the admin portal.
2. Microsoft Exchange Online Tenants: Use Microsoft's extended timeline proactively. Immediately inventory all applications and devices using SMTP AUTH with Basic Authentication. Begin migrating them to Modern Authentication (OAuth 2.0) or alternative secure submission methods. Microsoft provides tools and logs to help identify this usage.
3. Strategic Planning: View authentication not as a set of discrete tools but as a critical, interconnected infrastructure. Conduct a holistic review of all authentication methods, from legacy protocols to modern federated identity. Develop a roadmap to eliminate Basic Authentication in all forms and ensure robust patch management for all identity providers and access gateways.

The events surrounding Fortinet and Microsoft are not isolated incidents. They are symptoms of a broader challenge in cybersecurity: managing the transition from an insecure past to a more secure future, while ensuring that the solutions built for that future are themselves secure. The integrity of the digital enterprise depends on getting this balance right.