Fortinet Releases Critical Security Updates for FortiOS, FortiManager, and FortiAnalyzer

Fortinet has announced coordinated security hardening updates for FortiOS, FortiManager, and FortiAnalyzer, scheduled for October 22, 2026.

These updates aim to address critical and high-severity vulnerabilities. The company urges customers to prioritize updating internet-facing systems and treat these upgrades as urgent, not routine maintenance.

In an announcement on October 21, Fortinet’s Chief Information Security Officer, Carl Windsor, said the releases will include fixes derived from frontier AI-assisted security testing. Updates for FortiMail and FortiAuthenticator will precede this coordinated rollout.

Fortinet Releases Critical Security Updates

Fortinet says frontier AI models can examine code paths, protocol handling, and configuration logic to identify weaknesses more efficiently than traditional testing methods. The company acknowledges contributions from Anthropic, OpenAI, Google, and SpaceX to this work.

Fortinet’s previously published testing methodology combines firmware analysis, threat modeling, source code review, and live penetration testing, with human analysts validating findings to keep AI-generated results within an established vulnerability assessment process.

AI’s offensive potential also underscores the urgency of these updates. Fortinet warns that attackers can reverse-engineer patches and develop exploits within hours or days.

Public firmware changes may expose vulnerable code through patch comparisons, and AI can help chain lower-severity weaknesses into more significant attacks.

The announced minimum fixed versions span four branches:

Product	8.0 branch	7.6 branch	7.4 branch	7.2 branch
FortiOS	8.0.2	7.6.8	7.4.13	7.2.14
FortiManager	8.0.2	7.6.8	7.4.12	7.2.13
FortiAnalyzer	8.0.2	7.6.8	7.4.12	7.2.13

Affected versions range from each listed branch’s initial release up to the version immediately preceding its fixed release.

FortiMail customers should upgrade to version 8.0.2, 7.6.7, or 7.4.9 or later within their respective branches. FortiMail deployments on version 7.2 must migrate to version 7.4 or later. Fixes for FortiAuthenticator are available in versions 8.0.4 and 6.6.11 or later.

The announcement does not specify individual CVEs, CVSS scores, exploitation prerequisites, or confirmed attacks. Public advisories are scheduled for release on November 10 through Fortinet’s PSIRT portal.

Fortinet recommends that organizations patch exposed systems first, with maintenance windows prioritized for October 22–23.

Administrators should inventory their deployments, back up configurations, and monitor for unusual administrative access or unauthorized configuration changes before and after performing upgrades.

Where immediate installation is not feasible, organizations should:

• Restrict HTTPS and SSH access to trusted IP addresses.
• Remove administrative access from external interfaces.
• Ensure FortiManager administration is not accessible via the internet.
• Enforce multifactor authentication and strong, unique administrator credentials.
• Utilize out-of-band management, VPN or SASE isolation, and applicable virtual patches.

While these controls reduce exposure, they do not replace the need for upgrades.

FortiSASE is scheduled for automatic updates before the rollout. FortiManager Cloud may require manual updates, while public cloud deployments must adhere to their providers’ release processes.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.