On October 21, 2026, Fortinet CISO Carl Windsor announced a "security hardening release" for FortiOS, FortiManager and FortiAnalyzer, with releases available from October 22. It follows similar updates for FortiMail and FortiAuthenticator.
Fortinet says these releases fix critical and high-severity flaws. But it publishes no CVE IDs, no FG-IR advisories and no scores: detailed advisories will only appear on November 10, 2026, Patch Tuesday, on the FortiGuard PSIRT page.
In other words: we know what to install, not yet what it fixes. That's no reason to wait — quite the opposite.
Why Not Wait Until November 10
Fortinet says so itself in the announcement: once fixes are published, comparing the old and new versions ("patch diffing") leads straight to the changed code, and so to the flaw. AI tools are shrinking that work to hours or days.
These flaws were in fact found through Fortinet's AI-assisted security testing program, run with Anthropic, OpenAI, Google and SpaceX. What an AI found on the defensive side, an AI can rediscover on the offensive side from the patch.
So the scenario to avoid is simple: the fixed releases are public from October 22, the details will be public on November 10, and every day in between works for the attacker doing the analysis themselves. For an internet-facing FortiGate estate, recent history isn't encouraging: several Fortinet flaws joined the CISA KEV catalog in recent months.
At the time of writing, Fortinet reports no exploitation of these flaws.
Versions to Install
Versions published by Fortinet; the fixed version is the first release in each branch that contains the fixes.
| Product | Branch | Affected versions | Install |
|---|---|---|---|
| FortiOS (FortiGate) | 8.0 | 8.0.0 → 8.0.1 | 8.0.2 or later |
| FortiOS (FortiGate) | 7.6 | 7.6.0 → 7.6.7 | 7.6.8 or later |
| FortiOS (FortiGate) | 7.4 | 7.4.0 → 7.4.12 | 7.4.13 or later |
| FortiOS (FortiGate) | 7.2 | 7.2.0 → 7.2.13 | 7.2.14 or later |
| FortiManager | 8.0 | 8.0.0 → 8.0.1 | 8.0.2 or later |
| FortiManager | 7.6 | 7.6.0 → 7.6.7 | 7.6.8 or later |
| FortiManager | 7.4 | 7.4.0 → 7.4.11 | 7.4.12 or later |
| FortiManager | 7.2 | 7.2.0 → 7.2.12 | 7.2.13 or later |
| FortiAnalyzer | 8.0 | 8.0.0 → 8.0.1 | 8.0.2 or later |
| FortiAnalyzer | 7.6 | 7.6.0 → 7.6.7 | 7.6.8 or later |
| FortiAnalyzer | 7.4 | 7.4.0 → 7.4.11 | 7.4.12 or later |
| FortiAnalyzer | 7.2 | 7.2.0 → 7.2.12 | 7.2.13 or later |
| FortiMail | 8.0 | 8.0.0 → 8.0.1 | 8.0.2 or later |
| FortiMail | 7.6 | 7.6.0 → 7.6.6 | 7.6.7 or later |
| FortiMail | 7.4 | 7.4.0 → 7.4.8 | 7.4.9 or later |
| FortiMail | 7.2 | 7.2.0 → 7.2.9 | move to the 7.4 branch or later |
| FortiAuthenticator | 8.0 | 8.0.0 → 8.0.3 | 8.0.4 or later |
| FortiAuthenticator | 6.6 | 6.6.0 → 6.6.10 | 6.6.11 or later |
⚠️ Watch the look-alike numbers: on 7.4, install 7.4.13 for FortiOS but 7.4.12 for FortiManager and FortiAnalyzer.
Managed services. FortiSASE is updated automatically by Fortinet. FortiManager Cloud updates are available but may need a manual step. Instances deployed in a public cloud are updated through that cloud provider.
Branches missing from the table. The announcement mentions neither FortiOS 7.0 nor 6.4, and doesn't say whether those branches are affected. If you still run them, get the answer from Fortinet support — and expect November 10 to present you with a done deal.
Check a FortiGate's version:
get system status
Order of Operations
Fortinet's recommendations, in the order to apply them:
- Inventory every FortiGate, FortiManager and FortiAnalyzer, including virtual and cloud instances.
- Back up the configuration of each device before upgrading.
- Upgrade internet-facing devices first, in a maintenance window Fortinet suggests planning for October 22–23.
- Watch the logs before and after upgrading: unusual administrative access, unapproved configuration changes.
If the upgrade has to wait, Fortinet recommends — without it replacing the upgrade:
- Out-of-band management, and administrative interfaces (HTTPS, SSH) restricted to trusted addresses or disabled on external interfaces;
- Never expose FortiManager to the internet;
- Putting resources behind a VPN or SASE where feasible;
- Virtual patching (IPS);
- Strong, unique credentials and multi-factor authentication on every administrator account.
Detection
With no detail on the flaws, monitoring focuses on generic signs of a network-device compromise:
- Unknown or recently created admin accounts:
show system admin - Admin logins from unusual addresses, especially over SSH or on an exposed web interface
- Configuration changes nobody made: policies, VPN, routes, DNS
- Unexplained process crashes or restarts
execute log filter category event
execute log display
diagnose debug crashlog read
Frequently Asked Questions
Which CVEs are fixed? Fortinet will only publish them on November 10, 2026. We'll update this article then with the IDs, scores and details.
Is my FortiGate affected? Yes, if its FortiOS version falls within the ranges in the table: a FortiGate runs FortiOS. Every maintained branch (8.0, 7.6, 7.4, 7.2) has a fixed release.
Can I wait for the details before deciding? That's exactly the bet Fortinet advises against: the fixes are public, and analyzing them can reveal the flaws well before November 10.
Why is Fortinet doing it this way? Fortinet says it is balancing transparency with customer security: giving time to upgrade before publishing exploitable details.
Why Continuous Monitoring of Your Fortinet Estate Matters
A critical update without CVEs triggers nothing in tools that only read vulnerability databases: there's nothing there to read yet. The day the CVEs appear, you'll need to know immediately which devices still run an affected version.
With cveo.tech, inventory your FortiGate, FortiManager and FortiAnalyzer devices with their exact versions, and get an alert as soon as the CVEs published on November 10 affect them.