Fortinet ships critical FortiGate fixes today and won’t say what they fix until November 10. Upgrade internet-facing firewalls first

If your company runs FortiGate firewalls, today is upgrade day. Fortinet says a coordinated set of releases for FortiOS, FortiManager and FortiAnalyzer comes out on Thursday, October 22, with critical and high-severity fixes.

There is a catch for planners. Fortinet will not publish the advisories that describe these bugs until November 10, so you are asked to upgrade before you can read what was fixed. Its CISO, Carl Windsor, wrote that customers should treat it as a priority change.

Fortinet ships FortiOS 7.6.8, 7.4.13 and 7.2.14 today with critical fixes it will not describe until November 10. Patch the firewalls the internet can reach first.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Fortinet ships critical fixes for FortiOS, FortiManager and FortiAnalyzer today

In a post on October 21, Fortinet said FortiOS, FortiManager and FortiAnalyzer releases arrive on October 22. The fixed FortiOS builds are 8.0.2, 7.6.8, 7.4.13 and 7.2.14. FortiManager and FortiAnalyzer move to 8.0.2, 7.6.8, 7.4.12 and 7.2.13.

FortiMail (8.0.2, 7.6.7, 7.4.9) and FortiAuthenticator (8.0.4, 6.6.11) updates were already available on October 21. FortiMail 7.2 gets no fix; Fortinet says to move to the 7.4 branch.

Fortinet says the bugs were found with frontier AI models in its own testing and thanks Anthropic, OpenAI, Google and SpaceX. The post does not say any of them are being exploited.

Internet-facing FortiGate firewalls and management consoles go first

FortiGate firewalls sit at the edge of a very large number of company networks, and FortiManager controls fleets of them. Fortinet’s own reason for urgency is patch diffing: once the update is out, attackers can compare old and new code to find the flaws, and Windsor wrote that AI tools now help do that “in hours or days, rather than weeks.”

FortiSASE is updated automatically before the release. FortiManager Cloud releases may need a manual update, and public cloud images arrive through each cloud provider’s own release process.

Book the FortiOS window for today or tomorrow

• List every FortiGate, FortiManager and FortiAnalyzer with its current version, and mark which ones expose HTTPS or SSH admin access to the internet.
• Back up each configuration, then book change windows for October 22 and 23, starting with internet-facing firewalls.
• Upgrade FortiMail and FortiAuthenticator now; those builds are already out.
• If a device has to wait, limit admin access to trusted IP addresses or turn it off on external interfaces, and keep FortiManager off the internet.

Details

• FortiOS: 8.0.0–8.0.1 to 8.0.2; 7.6.0–7.6.7 to 7.6.8; 7.4.0–7.4.12 to 7.4.13; 7.2.0–7.2.13 to 7.2.14. Available October 22.
• FortiManager and FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12, 7.2.13. Available October 22.
• FortiMail: 8.0.2, 7.6.7, 7.4.9 (7.2 users move to 7.4). FortiAuthenticator: 8.0.4, 6.6.11. Available October 21.
• Advisories: to be posted on the FortiGuard PSIRT page on November 10. No CVE IDs published yet. No exploitation reported by Fortinet.

Hunt / verify

• Before and after upgrading, review FortiGate and FortiManager logs for admin logins from unfamiliar IP addresses and configuration changes nobody approved.
• Run get system status on each FortiGate after the upgrade to confirm the running version.
• Check the FortiGuard PSIRT page on November 10 and map the advisories to the versions you installed.

Source: Fortinet CISO Collective, October 21, 2026

Sources

• Fortinet: Fortinet Releases Security Hardening Release for Multiple Products
• FortiGuard Labs: PSIRT advisories

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].