www.it-connect.fr
FortiGate, FortiManager: Fortinet Urges Immediate Patching Without Saying Why
After PHP, it’s now Fortinet’s turn. On October 22, 2026, the vendor rolled out a wave of updates for FortiOS, FortiManager and FortiAnalyzer, addressing critical flaws discovered with the help of AI. The technical details, however, will not be published until November 10. Here’s what you need to know.
On October 21, 2026, Fortinet CISO Carl Windsor announced a coordinated security update for several Fortinet products. And not just any products, since this alert affects three Fortinet pillars: FortiOS (the operating system behind FortiGate firewalls), FortiManager and FortiAnalyzer. These new releases follow those for FortiMail and FortiAuthenticator, which were already made available a few hours earlier. Fortinet is talking about security patches for critical and high-severity flaws, without specifying how many.
However, they do have one thing in common: these vulnerabilities were identified as part of Fortinet’s security testing program assisted by frontier AI models. We have a rough idea of the models and tools used by Fortinet, since the US vendor thanks Anthropic, OpenAI, Google and SpaceX for their collaboration. In late June, Fortinet also detailed its use of AI tools as part of Anthropic’s Glasswing (Mythos) and OpenAI’s Daybreak (GPT-5.5 Cyber) projects.
If you already patched your web servers to protect against PHP2Shell flaws and you use Fortinet solutions, you still have more work ahead of you.
The versions to install
Fortinet is asking customers to treat these updates as a priority, not as a routine maintenance cycle, starting with systems exposed to the Internet. Here are the fixed versions available since October 21 or 22, depending on the product:
- FortiOS : 8.0.2, 7.6.8, 7.4.13 et 7.2.14
- FortiManager : 8.0.2, 7.6.8, 7.4.12 et 7.2.13
- FortiAnalyzer : 8.0.2, 7.6.8, 7.4.12 et 7.2.13
- FortiMail : 8.0.2, 7.6.7 and 7.4.9, already available. The 7.2 branch will not receive a fix, so you need to migrate to 7.4 or a newer version
- FortiAuthenticator : 8.0.4 and 6.6.11, already available
The security bulletins will be published during Fortinet’s next Patch Tuesday, on November 10, on the FortiGuard PSIRT portal. Until then: no CVE, no CVSS score, no description. You will be patching blind... while trusting Fortinet that these are critical and urgent fixes.
Why is Fortinet pushing customers so hard?
The question you may ask is this: why doesn’t Fortinet wait and instead pressure customers now? Certainly not for fun. Fortinet explains this urgency with the following points:
- Criticality : the fixes include critical and high-severity vulnerabilities
- Accelerated exploitation : AI now helps reverse-engineer a patch and produce a working exploit in a matter of hours or days, instead of several weeks
- Patch diffing : as soon as a patch is released, it reveals where the code changed, making unpatched systems easier targets
- Chaining : AI can link low-severity flaws with no obvious connection to create a more serious exploitable vulnerability
"The window between disclosure and exploitation continues to shrink", warns Carl Windsor. That is an excellent point from Fortinet’s CISO, and it is pushing vendors to rethink their disclosure strategy. In June, Fortinet noted that the models tested against its firmware found few new exploitable flaws, but excelled at comparing two versions and generating PoCs for issues that had already been fixed.... In other words, the danger is concentrated in the days following publication. And if I need to say it again: Fortinet devices are prime targets and are constantly being attacked.
If you cannot update your device right away, Fortinet recommends restricting administrative interfaces (HTTPS, SSH) to trusted IP addresses, or disabling them on external interfaces.
