Fortinet “security hardening release” for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator: critical fixes, details withheld until 10 November
Fortinet shipped critical and high-severity fixes found by AI-assisted testing; details come on 10 November. Upgrade internet-facing FortiGates first.
- Published
- Updated
- Ecosystem
- Network edge
- Fixed in
- FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14; FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiMail 8.0.2, 7.6.7, 7.4.9; FortiAuthenticator 8.0.4, 6.6.11
- Exploitation
- No exploitation reported by Fortinet as of 21 October 2026; no CVEs published yet
What happened
On 21 October 2026, Fortinet’s CISO Carl Windsor announced a “security hardening release” across five products. Fortinet says the builds include “critical and high-severity fixes” for issues found by its AI-assisted security testing programme. FortiMail and FortiAuthenticator builds were released on 21 October; FortiOS, FortiManager and FortiAnalyzer followed on 22 October (Fortinet).
Fortinet is holding back the advisories. It will publish them on Patch Tuesday, 10 November 2026, on its PSIRT page. No CVE numbers have been released. The post does not say any of the bugs are being exploited. It does warn that AI tools can help attackers reverse-engineer patches and build exploits in hours or days, and that patch diffs can reveal the weaknesses (Fortinet).
Why this matters
You have a known window. Until 10 November, the fixes exist but the bugs are not described. After that, every advisory points attackers at a diffable patch. Fortinet’s own guidance is to treat this as a priority change and to schedule internet-facing systems first. Waiting for CVE numbers before patching gives away the head start Fortinet is trying to give you.
Am I affected?
Every build below the fixed version in each branch is affected (Fortinet):
| Product | Affected | Fixed |
|---|---|---|
| FortiOS 8.0 | 8.0.0 to 8.0.1 | 8.0.2 |
| FortiOS 7.6 | 7.6.0 to 7.6.7 | 7.6.8 |
| FortiOS 7.4 | 7.4.0 to 7.4.12 | 7.4.13 |
| FortiOS 7.2 | 7.2.0 to 7.2.13 | 7.2.14 |
| FortiManager / FortiAnalyzer 8.0 | 8.0.0 to 8.0.1 | 8.0.2 |
| FortiManager / FortiAnalyzer 7.6 | 7.6.0 to 7.6.7 | 7.6.8 |
| FortiManager / FortiAnalyzer 7.4 | 7.4.0 to 7.4.11 | 7.4.12 |
| FortiManager / FortiAnalyzer 7.2 | 7.2.0 to 7.2.12 | 7.2.13 |
| FortiMail 8.0 | 8.0.0 to 8.0.1 | 8.0.2 |
| FortiMail 7.6 | 7.6.0 to 7.6.6 | 7.6.7 |
| FortiMail 7.4 | 7.4.0 to 7.4.8 | 7.4.9 |
| FortiMail 7.2 | 7.2.0 to 7.2.9 | No fix; move to 7.4 or later |
| FortiAuthenticator 8.0 | 8.0.0 to 8.0.3 | 8.0.4 |
| FortiAuthenticator 6.6 | 6.6.0 to 6.6.10 | 6.6.11 |
The table lists no fixed builds for FortiOS 7.0 or 6.4, or FortiManager and FortiAnalyzer 7.0. Fortinet has not said whether those branches are affected.
On FortiOS, check the running version from the CLI:
get system statusThen check that no administrative access is enabled on internet-facing interfaces:
show system interfaceLook for https, ssh or http in the set allowaccess line of each WAN interface.
FortiSASE was updated by Fortinet before the release. FortiManager Cloud was available for update by 22 October but may need you to start the update manually. Public cloud marketplace images are being updated through each cloud partner’s own process (Fortinet).
What to do now
- Upgrade internet-facing FortiGates first, then FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Back up configurations before upgrading. Aim to finish before 10 November.
- Move FortiMail 7.2 to 7.4.9 or later. There is no 7.2 fix.
- Update FortiManager Cloud manually if it has not picked up the new build.
- Until you upgrade, restrict HTTPS and SSH administration to trusted IP addresses or disable it on external interfaces, make sure FortiManager is not reachable from the internet, manage devices out of band, and apply FortiGuard virtual patches (Fortinet).
- Watch admin activity before and after patching. Fortinet asks customers to monitor logs for unusual administrative access and unapproved configuration changes, and to enforce MFA on all administrator accounts.
- Recheck on 10 November. Read the new FortiGuard advisories for any workaround, indicator or branch (such as FortiOS 7.0) that this post does not cover.