Fortinet Urges Customers to Patch Critical Flaws Affecting FortiOS, FortiManager, and FortiAnalyzer

Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated release addresses critical and high-severity vulnerabilities, including flaws found through AI-assisted security testing. The company said customers should address internet-facing devices first.

In an October 21 announcement, Fortinet Chief Information Security Officer Carl Windsor warned customers against treating these fixes as routine maintenance. The update follows security releases for FortiMail and FortiAuthenticator, extending the patching effort across several key products.

Fortinet said its testing program uses advanced AI models to examine code paths, protocol handling, and configuration logic. The company thanked Anthropic, OpenAI, Google, and SpaceX for their work with its security teams.

The concern extends beyond finding new bugs. Fortinet warned that attackers can use AI to compare patched and older software, identify changed code, and build exploits within hours or days. This process, known as patch diffing, can expose weaknesses before customers finish upgrading.

AI may also help attackers combine lower-severity flaws into a more serious attack chain. However, the announcement does not provide individual CVE identifiers, CVSS scores, or detailed attack conditions for this release. It also does not report active exploitation of these newly addressed flaws.

Its earlier testing report also stressed human review. Security analysts validate AI findings and test whether they are exploitable, helping separate real vulnerabilities from false alarms and recommend product security improvements.

Affected Versions and Required Updates

FortiOS customers should move to version 8.0.2, 7.6.8, 7.4.13, or 7.2.14, depending on their current branch. Affected releases span 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, and 7.2.0–7.2.13.

FortiManager and FortiAnalyzer share the same minimum fixed releases: 8.0.2, 7.6.8, 7.4.12, and 7.2.13. Their affected versions cover 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, and 7.2.0–7.2.12. Fortinet lists October 22 availability for all these updates.

For FortiMail, the fixed versions are 8.0.2, 7.6.7, and 7.4.9. Customers running affected FortiMail 7.2 releases must move to the 7.4 branch or later. FortiAuthenticator users should install 8.0.4 or 6.6.11, depending on their branch.

Fortinet plans to publish public advisories on its PSIRT page on November 10. Its notice says FortiSASE will receive automatic updates before the coordinated release. FortiManager Cloud updates may require manual action, while public cloud updates follow the relevant cloud provider’s release process.

The gap between firmware availability and full public disclosure gives customers time to upgrade before detailed advisories appear. It does not mean exposed devices can safely wait until November. Fortinet explicitly asks customers to act when the updates become available, rather than delay for technical details.

PHP and Node.js Add Patching Pressure

The warning comes alongside separate PHP and Node.js security releases. These are distinct issues, not confirmed components of the Fortinet vulnerabilities.

PHP released emergency patches on October 21 for CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Both can allow remote code execution without authentication. One involves memory exhaustion leaving incomplete request data, while the other involves stale request state surviving after memory is freed.

Cybersecurity News’s PHP2Shell coverage explains the risks across different server setups. Fixed PHP releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP Foundation also described how AI-assisted research contributed to investigating these weaknesses.

Separately, the Node.js security update addresses ten vulnerabilities, including four rated high severity. CVE-2026-111497 affects Brotli decompression and can allow code execution through an out-of-bounds memory write. Other high-severity fixes address TLS hostname verification bypasses and DNS name truncation. The affected supported branches are 26.x, 24.x, and 22.x.

Fortinet recommends identifying exposed systems, backing up configurations, and scheduling urgent maintenance windows for October 22–23. Teams should review logs for unusual administrator access and unauthorized configuration changes before and after patching.

Where upgrades cannot happen immediately, administrators should restrict HTTPS and SSH management to trusted addresses, remove FortiManager administration from the public internet, and enforce multifactor authentication with unique passwords. These controls reduce exposure but do not replace installing the security updates.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.