How to Upgrade a FortiGate to FortiOS 7.4.13 or 7.6.8: Builds, Upgrade Order and Known Issues

The releases from Fortinet's "security hardening release" have been available since October 22, 2026. The CVEs they fix won't be published until November 10, but Fortinet asks customers to upgrade now — we explained why in our article on this security update.

This guide answers the next question: how to move a FortiGate estate to 7.4.13 or 7.6.8 without breaking production. Everything below comes from Fortinet's official release notes.

The Builds to Install

Stay on your branch: going from 7.4.12 to 7.4.13 is a maintenance update. Switching branches (7.4 to 7.6) is a separate project with its own behavior changes — don't mix it with the security emergency.

Check a FortiGate's version and build:

get system status

1. Follow the Security Fabric Upgrade Order

The 7.4.13 release notes set an order: devices that manage other devices go first.

1. FortiAnalyzer
2. FortiManager
3. FortiGate
4. Managed FortiExtender
5. Managed FortiSwitch
6. Managed FortiAP
7. FortiClient EMS, then FortiClient
8. The other Fabric products (FortiSandbox, FortiMail, FortiWeb, FortiNAC…)

For 7.4.13, Fortinet lists compatibility with FortiAnalyzer and FortiManager 7.4.10. Since FortiManager and FortiAnalyzer are themselves part of the security update (7.4.12 on the 7.4 branch), the logical sequence is: FortiAnalyzer 7.4.12, FortiManager 7.4.12, then the FortiGates to 7.4.13.

Security Fabric enabled: every FortiGate in the Fabric must be upgraded to the same version — the 7.4.13 notes are explicit about it.

2. Check the Upgrade Path

Depending on your starting version, you may need intermediate releases. Fortinet doesn't list those paths in the release notes: it points to its Upgrade Path Tool in the documentation library (model, current version, target version).

⚠️ The 7.4.13 notes recall a known limitation: on some earlier versions, upgrading from the web interface doesn't respect the upgrade path and can skip intermediate steps, with a risk of losing part of the configuration. If the path has several steps, install each intermediate version one at a time.

3. Prepare Each Device

• Back up the configuration right before upgrading (web interface: admin account menu, Configuration > Backup; or from the CLI, for example execute backup config usb <file>).
• Verify the downloaded image's integrity: the release notes have a Firmware image checksums section, and checksums are available on the Fortinet support portal.
• Read the target version's "Special notices": for 7.6.8 they flag, among others, a case where the configuration can't be restored after private data encryption is re-enabled, and FortiManager support for FortiOS's updated encryption key. For 7.2.14 they warn of an admin access lockout risk when upgrading or downgrading from versions with PBKDF2 support.
• Plan the rollback: the Downgrading to previous firmware versions section of the release notes says what is kept and what is lost.

4. HA Clusters: the Known Pitfalls

Known issues listed by Fortinet that directly affect upgrading a cluster:

Before and after upgrading a cluster:

get system ha status
diagnose sys ha checksum cluster

5. Known Issues to Check Before Installing

FortiOS 7.4.13:

• 1353958 — explicit proxy. A known issue tied specifically to upgrading to this security update's builds: non-standard HTTPS ports (such as 8443) with deep inspection return ERR_EMPTY_RESPONSE. If you run the explicit proxy on such ports, test before rolling out widely.
• 1035490 — 2 GB RAM models. A policy with proxy-based inspection may stop working after the upgrade. Workaround: reboot the FortiGate.
• 1213236 — FortiGate 700G / 701G. The default port speed changed as of 7.4.9: interfaces may go down after the upgrade. Workaround: set the port speed to auto.

FortiOS 7.6.8:

• 1336373 — FortiGate 6000/7000 (the only new issue in this release). A 100G FR transceiver link fails on port 1-P4 when RS-FEC is enabled; it works with FEC disabled.
• 1113304 — managed FortiSwitches. They can go offline after upgrading from 7.4.6 or 7.6.0 if LLDP is disabled on the FortiLink interface. Workaround: enable LLDP reception and transmission on FortiLink, or rebuild the FortiLink interface.
• 1125805 — FortiGate VM on AWS. The web interface becomes unreachable when ACME is enabled.
• 1035490 also applies to 2 GB models on 7.6.8.

The full list runs to over a hundred entries for 7.4.13 and about sixty for 7.6.8: go through the sections that touch your features (IPsec VPN, SD-WAN, HyperScale…).

6. After the Upgrade

1. Check version and build: get system status.
2. Check the HA cluster state and synchronization.
3. Check VPN tunnels, routing and policies that use interfaces: the 7.4.13 and 7.6.8 release notes both flag that some policies may show empty values after an upgrade.
4. Watch the administration logs, as Fortinet recommends in its announcement: unusual access, unapproved changes.

Frequently Asked Questions

Should I wait for the CVEs on November 10? No. Fortinet asks customers to upgrade from October 22, starting with internet-facing devices.

Can I go straight from 7.4.x to 7.6.8? That's a branch change: it depends on the Upgrade Path Tool and on 7.6's behavior changes. For the security fix, 7.4.13 is enough.

What about FortiOS 7.0 or 6.4? Fortinet's security update doesn't mention them. Ask Fortinet support and plan a move to a maintained branch.

Why Continuous Monitoring of Your Fortinet Estate Matters

A successful upgrade campaign is verified device by device: one FortiGate forgotten on 7.4.12 is all it takes for November 10 to leave it exposed.

With cveo.tech, keep an inventory of your FortiGate, FortiManager and FortiAnalyzer devices with their exact versions, and get an alert as soon as the November 10 CVEs affect a device left behind.