FortiOS / FortiManager / FortiAnalyzer / FortiMail / FortiAuthenticator — critical & high severity flaws found with AI assistance, details embargoed until Nov 10
Severity: critical · Patch status: patched · Since 2026-10-26
Fortinet released security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator fixing critical and high severity vulnerabilities, with details withheld until November 10, 2026. The flaws were discovered using frontier and on-premises AI models (black-box firmware analysis and source-code review across 30 product families; ~40% of findings were real vulnerabilities) and validated by humans. Fortinet warns attackers with AI tools can chain lower-severity flaws and that exploitation windows after disclosure keep shrinking. Fortinet devices are frequent attack targets, and some flaws may be remotely exploitable without authentication. The updates do not address the PHP2Shell vulnerabilities, which do not affect these products. No in-the-wild exploitation is reported. Fixed builds are available for all listed branches; internet-facing systems should be patched first.
What to do
- Upgrade internet-facing Fortinet devices immediately to fixed builds in the listed branches
- Upgrade remaining FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator deployments before the November 10 disclosure
- Restrict admin access to trusted IPs, keep FortiManager off the internet, use strong unique credentials, and enforce MFA for admin accounts as interim mitigation
- Monitor for exploitation activity after details publish on November 10
Fixed versions
- FortiOS/FortiManager/FortiAnalyzer 8.0, 7.6, 7.4, 7.2 (latest builds)
- FortiMail 8.0, 7.6, 7.4 (7.2 users upgrade to 7.4+)
- FortiAuthenticator 8.0, 6.6 (latest builds)
Sources
All live incidents on Threat Watch
