Fortinet patches critical AI-found flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator
Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator
Fortinet shipped a coordinated security hardening release fixing critical and high-severity vulnerabilities found by its frontier AI-assisted testing program. Fixes for FortiMail and FortiAuthenticator came out Oct 21 and for FortiOS, FortiManager and FortiAnalyzer on Oct 22, 2026. CVE IDs and advisories are withheld until Fortinet's November 10 Patch Tuesday, and Fortinet warns attackers can use AI to reverse-engineer the patches, so it urges upgrading now, starting with internet-facing devices.
Why this severity: Rated critical and high by Fortinet; CVEs and CVSS scores due Nov 10, 2026; no exploitation reported yet
- Started
- Oct 21, 2026
Affected
- FortiOS 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, 7.2.0–7.2.13
- FortiManager and FortiAnalyzer 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, 7.2.0–7.2.12
- FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9
- FortiAuthenticator 8.0.0–8.0.3, 6.6.0–6.6.10
Fixed in
- FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14
- FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13
- FortiMail 8.0.2, 7.6.7, 7.4.9 (7.2 users move to 7.4 or later)
- FortiAuthenticator 8.0.4, 6.6.11
Timeline4
Help Net Security notes the release got little attention amid PHP2Shell and that the products aren't affected by PHP2Shell; interim mitigations (trusted-IP admin access, FortiManager off the internet, MFA) don't replace upgrading.
NHS England Digital issues cyber alert CC-4879 urging organisations to assess exposure and apply the updates.
Fixed FortiOS, FortiManager and FortiAnalyzer releases become available; FortiSASE is updated automatically and FortiManager Cloud may need a manual update.
Fortinet CISO Carl Windsor announces the security hardening release and ships FortiMail and FortiAuthenticator fixes; advisories are held until the Nov 10 Patch Tuesday.
Advisories2
News & write-ups2
Posts1
‼️ Fortinet is telling customers to patch its firewalls now but won't say what the critical flaws are until November 10. Its AI testing found them with help from Anthropic, OpenAI, Google and SpaceX. It says AI now lets attackers turn a patch into an exploit in hours or days. t.co/YcQkeZYwVr
Notes & caveats
No CVE IDs yet; add them, CVSS scores and per-bug details when Fortinet publishes advisories on Nov 10, 2026.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
