Fortinet has fixed critical and high severity flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. It will not publish the advisories until 10 November 2026, so the fixed builds are the main public clue. Upgrade internet-facing devices first.
Fortinet’s chief information security officer wrote on 21 October that these releases include fixes for flaws found by its frontier AI-assisted testing program. The company says the same class of AI capability is becoming available to attackers.
Last updated: 26 October 2026. Every fact about this release comes from Fortinet, from CISA or from the release notes listed under Sources.
Which Builds Fix the Flaws?
Fortinet lists a fixed version for each product branch. If your build is lower than the number in your branch, you are in the affected range.
| Product | 8.0 | 7.6 | 7.4 | 7.2 |
|---|---|---|---|---|
| FortiOS | 8.0.2 | 7.6.8 | 7.4.13 | 7.2.14 |
| FortiManager | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
| FortiAnalyzer | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
| FortiMail | 8.0.2 | 7.6.7 | 7.4.9 | Move to 7.4 or later |
FortiAuthenticator has two branches in the notice: 8.0.4 or above on 8.0, and 6.6.11 or above on 6.6. Fortinet lists the FortiMail and FortiAuthenticator builds as already available on 21 October and calls them recent releases. It scheduled FortiOS, FortiManager and FortiAnalyzer for 22 October.
Fortinet said FortiSASE would be updated automatically before the 22 October release. FortiManager Cloud releases were due by 22 October but may need a manual update. Public cloud images follow each cloud partner’s own release process. The release notes for FortiOS 7.6.8 and FortiManager 7.6.8 are in Fortinet’s document library.
Why Not Wait for 10 November?
Fortinet gives four reasons. The fixes include critical and high severity items. In its words, AI tools can help attackers reverse-engineer patches and build working exploits in hours or days. Once an update is public, the changed code points to the weak spot, and AI can chain lower severity flaws into a worse one.
Fortinet devices already have a long record with attackers, as the two Fortinet events of 2026 showed. In its 23 October 2026 release, the CISA Known Exploited Vulnerabilities catalog lists 32 Fortinet entries. Fourteen are marked as used in ransomware campaigns, and fifteen name FortiOS among their products.
FortiMail is in the catalog too, for example the FortiMail zero-day CVE-2026-104286. Fortinet’s advisory FG-IR-26-175 names the same FortiMail builds as the fix for that flaw. Our pages on the FortiOS SSL VPN flaw CVE-2024-21762 and the FortiOS authentication bypass CVE-2024-55591 show how past Fortinet bugs were used. See also what known exploited vulnerabilities means for patch order.
- List every deviceFind each FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator you run, internet-facing ones first.
- Read the release notesCheck the special notices for your target build before you upgrade, and test the upgrade path.
- Back up the configurationSave a copy of each configuration before you start.
- Upgrade in this orderFortinet asked for internet-facing systems first. Its suggested windows were 22 and 23 October, so schedule now if you missed them.
- Limit the admin interface until thenAllow HTTPS and SSH only from trusted addresses, keep FortiManager off the internet and enforce MFA with unique credentials.
- Watch the logsLook for unusual administrator access or unapproved configuration changes before and after the upgrade.
- Match advisories on 10 NovemberWhen Fortinet publishes the CVE ids, check each one against the build you now run.
Fortinet also suggests managing devices out of band, moving resources behind a VPN or SASE where possible, and applying virtual patches until the upgrade. It calls these temporary mitigations until patching can be prioritized. Our guide to patch management covers the process.
How Were the Flaws Found?
Fortinet described its AI testing program on 30 June 2026. It first tested firmware as an attacker would, without source code. That found few exploitable flaws. The models were very good, though, at comparing firmware versions and building proof-of-concept exploits for known, fixed flaws.
Fortinet then used the models on source code. It reports more than 100 tests across 30 product families. At the time of writing, 40 percent of results were true positives, 30 percent were false positives and 30 percent were security best practices rather than flaws.
Fortinet says its analysts review every finding by hand, and it uses penetration testing extensively to triage the results. In the October post it thanks Anthropic, OpenAI, Google and SpaceX for their collaboration.
What Changes for Defenders?
The June finding matters most here. A fixed flaw is easier to turn into an exploit when a model can compare the old and new firmware. That shortens the time between a patch and the first attack, and it makes the gap before 10 November a risk of its own.
For a recent example of a Fortinet flaw with a public proof of concept, read our FortiSIEM CVE-2026-106173 post. It is a separate advisory, not part of this release. For another side of the AI trend, see how crews use AI in our post on AI tools ransomware crews use.
Fortinet’s PSIRT page will carry the advisories. We will update this post with the CVE ids once they are published. Reduce your attack surface now: a management interface that is not on the internet cannot be reached by a freshly written exploit.