Fortinet urges priority upgrades as it fixes critical FortiOS and FortiManager flaws

Fortinet has released coordinated security updates for FortiOS, FortiManager and FortiAnalyzer, following fixes for FortiMail and FortiAuthenticator a day earlier, and is urging customers to treat the upgrades as a priority change rather than routine maintenance. In a blog post published on October 21, Fortinet CISO Carl Windsor said the releases address critical and high-severity vulnerabilities, with the FortiOS, FortiManager and FortiAnalyzer builds made available on October 22. Because the firewall and management products are widely deployed at the network edge, the release is significant for a large number of organizations.

What happened

According to Fortinet, the vulnerabilities were identified through its "frontier AI-assisted security testing program," which used frontier models to analyze code paths, protocol handling and configuration logic. The company said this surfaced issues more efficiently than traditional fuzzing and manual review, and thanked Anthropic, OpenAI, Google and SpaceX for their collaboration.

Fortinet has not published CVE identifiers, CVSS scores or technical details. The company said public advisories will appear on its PSIRT page on Patch Tuesday, November 10. Fortinet justified the urgency by pointing to the severity of the fixes, faster weaponization of patches by attackers using AI, the risk that patch diffing reveals the flaws, and the ability of AI tools to chain lower-severity bugs into more serious attacks. "The window between disclosure and exploitation continues to shrink," Windsor wrote.

The blog post does not say that any of the flaws are being exploited, and SecurityOnline reported that Fortinet is not aware of in-the-wild exploitation or public proof-of-concept code.

Who is affected

Fortinet lists the following minimum fixed versions:

• FortiOS: 8.0.2, 7.6.8, 7.4.13, 7.2.14
• FortiManager and FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12, 7.2.13
• FortiMail: 8.0.2, 7.6.7, 7.4.9; FortiMail 7.2 users must upgrade to the 7.4 branch or later
• FortiAuthenticator: 8.0.4, 6.6.11

FortiSASE is updated automatically, while FortiManager Cloud may require a manual update, the company said. Public cloud instances are being updated through cloud partners.

What to do

Fortinet recommends inventorying all FortiOS and FortiManager instances and upgrading as soon as possible, starting with internet-facing devices. Administrators should back up configurations before upgrading and monitor logs for unusual administrative access or unapproved changes before and after patching.

Where an immediate upgrade is not possible, Fortinet advises restricting HTTPS and SSH administrative access to trusted IP addresses or disabling it on external interfaces, keeping FortiManager administration unreachable from the internet, managing devices out of band, applying virtual patches and enforcing MFA with strong, unique credentials for all administrator accounts. The company stressed that these interim steps "do not replace the need for a timely upgrade."