Fortinet schedules urgent fixes for critical and high-risk flaws
Fortinet has announced unscheduled updates for several products, with the releases expected this Thursday. The fixes address critical and high-risk security issues, making internet-facing Fortinet appliances the first priority for organizations that operate them as firewalls or VPN gateways.
The affected product lines are FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Planned fixed branches include FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14; FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13; FortiMail 8.0.2, 7.6.7 and 7.4.9; and FortiAuthenticator 8.0.4 and 6.6.11. FortiMail users on the 7.2.x line are told to migrate to 7.4 or newer.
Fortinet advises customers to schedule and apply the updates as soon as they become available, starting with devices exposed to the internet. If an immediate update is not possible, administrators should temporarily reduce exposure by limiting HTTPS and SSH administration to trusted IP addresses, disabling those interfaces externally, and managing the devices through a separate management network.
The rollout is not identical across the product range. FortiSASE is expected to update automatically by Thursday, while FortiManager Cloud updates should be available by then but may require manual installation. Teams should therefore verify the update status of each deployment rather than assume that every Fortinet service will change automatically.
Fortinet attributes the newly identified flaws to its security testing program, which uses frontier AI models to examine code paths, protocol handling and configuration logic. The company has not yet supplied vulnerability details in the announcement; it says security advisories will be published on the Fortinet Patchday on 10 November 2026.
That disclosure schedule increases the importance of patch timing. Fortinet warns that AI-assisted analysis could allow attackers to study patches and develop working exploits faster after the fixes reveal where code was changed. The available report does not identify individual vulnerability numbers or affected components beyond the named products and release branches, so administrators should rely on the vendor's update notices for the final technical scope.