Affected product(s):
| Product | Affected Versions |
| FortiOS | 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.12, and 7.2.0 to 7.2.13 |
| FortiManager | 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.11, and 7.2.0 to 7.2.12 |
| FortiAnalyzer | 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.11, and 7.2.0 to 7.2.12 |
| FortiMail | 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8, and 7.2.0 to 7.2.9 |
| FortiAuthenticator | 8.0.0 to 8.0.3 and 6.6.0 to 6.6.10 |
Description
A set of critical- and high-severity vulnerabilities has been reported in Fortinet’s FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator products. The flaws were identified by Fortinet’s security testing program, which is powered by frontier AI models and analyzes code paths, protocol handling, and configuration logic.
On October 21, 2026, Fortinet announced a coordinated release of updates: fixed versions of FortiMail and FortiAuthenticator are available as of that day, while those for FortiOS, FortiManager, and FortiAnalyzer are available as of October 22, 2026.
On November 10, 2026, Fortinet will publish the CVE identifiers, CVSS scores, and technical details on its PSIRT page. Monitor the advisory for updates and do not wait until that date to apply the patches. Beacon Lab will update this bulletin when the details are published.
The vendor urges that these updates be treated as a priority change rather than routine maintenance. It warns that, once the patches are released, version comparison (patch diffing) can reveal the areas that were fixed, AI tools can be used to develop exploits within hours or days, and lower-severity vulnerabilities can be chained together to achieve greater impact.
On October 23, 2026, Australia’s ASD’s ACSC issued an alert with a critical rating and stated that it was not aware of any active exploitation of these vulnerabilities in Australia.
Mitigation
If it is not possible to update immediately, Fortinet recommends reducing exposure with the following measures:
- Restrict administrative interfaces (HTTPS, SSH) to trusted IP addresses or disable them on external interfaces.
- Ensure that FortiManager administration is not accessible from the Internet.
- Manage devices out of band and place resources behind VPN or SASE where possible.
- Apply virtual patches until the devices can be updated.
- Use strong, unique credentials and require MFA for all administrator accounts.
- Review logs for unusual administrative access or unapproved configuration changes before and after updating.
According to Fortinet, these measures reduce risk but do not replace the need to update.
Solution
The solution is to update each device to the fixed version for its branch or a later version, prioritizing devices exposed to the Internet. Backing up the configuration before updating is recommended.
FortiOS
| Branch | Affected Versions | Fixed Version |
| 8.0 | 8.0.0 to 8.0.1 | 8.0.2 or later |
| 7.6 | 7.6.0 to 7.6.7 | 7.6.8 or later |
| 7.4 | 7.4.0 to 7.4.12 | 7.4.13 or later |
| 7.2 | 7.2.0 to 7.2.13 | 7.2.14 or later |
FortiManager and FortiAnalyzer
| Branch | Affected Versions | Fixed Version |
| 8.0 | 8.0.0 to 8.0.1 | 8.0.2 or later |
| 7.6 | 7.6.0 to 7.6.7 | 7.6.8 or later |
| 7.4 | 7.4.0 to 7.4.11 | 7.4.12 or later |
| 7.2 | 7.2.0 to 7.2.12 | 7.2.13 or later |
FortiMail
| Branch | Affected Versions | Fixed Version |
| 8.0 | 8.0.0 to 8.0.1 | 8.0.2 or later |
| 7.6 | 7.6.0 to 7.6.6 | 7.6.7 or later |
| 7.4 | 7.4.0 to 7.4.8 | 7.4.9 or later |
| 7.2 | 7.2.0 to 7.2.9 | Migrate to the 7.4 branch or later |
FortiAuthenticator
| Branch | Affected Versions | Fixed Version |
| 8.0 | 8.0.0 to 8.0.3 | 8.0.4 or later |
| 6.6 | 6.6.0 to 6.6.10 | 6.6.11 or later |
FortiSASE updates automatically. FortiManager Cloud may require a manual update, and instances in public clouds are updated through each provider’s process.
For information on how to upgrade, visit the following link (Fortinet Upgrade Path Tool):
https://docs.fortinet.com/upgrade-tool
Firmware download (Fortinet Support portal):
Additional information:
- Fortinet — Fortinet Releases Security Hardening Release for Multiple Products (affected and fixed versions):
https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products - Fortinet PSIRT — security advisories (scheduled for publication on 10/11/2026):
https://www.fortiguard.com/psirt - Fortinet — FortiOS 7.6.8 release notes:
https://docs.fortinet.com/product/fortigate/7.6 - ASD’s ACSC — Critical vulnerabilities in Fortinet products:
https://www.cyber.gov.au/alert/critical-vulnerabilities-in-fortinet-products - CCB Belgium — Fortinet Releases Critical Security Hardening Updates for Multiple Products:
https://ccb.belgium.be/advisories/warning-fortinet-releases-critical-security-hardening-updates-multiple-products-patch