Fortinet patches critical FortiOS flaws, details held to November 10
Original title: Fortinet patches critical FortiOS flaws found with AI help
Fixes cover FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; Fortinet says public diffs will show attackers where to look.
Fortinet shipped security hardening updates last week but will not describe the vulnerabilities until November 10, 2026. CISO Carl Windsor said AI models found the issues and humans validated them, and Fortinet rated them critical and high, so some may be remotely exploitable without authentication. He told administrators to upgrade now, especially internet-facing systems. The packages do not fix PHP2Shell; those products are not affected.
Unconfirmed: CVE identifiers, exact affected versions and whether any flaw is being exploited are not disclosed until November 10.
- Fixed branches for FortiOS, FortiManager and FortiAnalyzer are 8.0, 7.6, 7.4 and 7.2.
- FortiMail fixes are 8.0, 7.6 and 7.4; FortiMail 7.2 should move to 7.4 or later.
- FortiAuthenticator fixes are on branches 8.0 and 6.6.
- In more than 100 tests of 30 product families, about 40% of AI findings were real vulnerabilities.
Impact: Possible unauthenticated remote exploitation; flaw details withheld
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiOS | — | 8.0, 7.6, 7.4 and 7.2 |
| Fortinet FortiManager | — | 8.0, 7.6, 7.4 and 7.2 |
| Fortinet FortiAnalyzer | — | 8.0, 7.6, 7.4 and 7.2 |
| Fortinet FortiMail | 7.2 customers told to leave that branch | 8.0, 7.6 and 7.4 |
| Fortinet FortiAuthenticator | — | 8.0 and 6.6 |
- 1.Upgrade to the listed fixed branches now, prioritizing internet-facing systems.
- 2.Until patched, limit admin access to trusted IPs, use unique credentials and MFA, and keep FortiManager off the internet.
- Vendors
- Fortinet
From the original article
2 min read at helpnetsecurity.com
Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Officer Carl Windsor explained in the advance announcement.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.