Fortinet urges October 22 patches; CVE details still unpublished
October 23: Canada's Cyber Centre issued AV26-1081, listing the same fixed builds and urging updates, still without CVE identifiers or attack details.
Fortinet has released October 22 fixes for critical and high-severity flaws and reports no active exploitation; CVE details remain unpublished.
Fortinet told customers to prioritize October 22, 2026 security updates for critical and high-severity flaws in FortiOS, FortiManager and FortiAnalyzer, and also listed fixes for FortiMail and FortiAuthenticator. Internet-facing systems should be patched first. The announcement gives no CVE identifiers, scores or attack conditions and does not report exploitation. Public PSIRT advisories are scheduled for November 10. On October 23, Canada's Cyber Centre issued advisory AV26-1081 covering the same product lines and urging administrators to apply the updates.
- FortiOS fixed builds are 8.0.2, 7.6.8, 7.4.13 and 7.2.14.
- FortiManager and FortiAnalyzer fixes are 8.0.2, 7.6.8, 7.4.12 and 7.2.13.
- FortiMail fixes are 8.0.2, 7.6.7 and 7.4.9; branch 7.2 must move to 7.4 or later.
- FortiAuthenticator fixes are 8.0.4 and 6.6.11 or later.
- Fortinet reports no active exploitation and has not published CVE identifiers.
- PSIRT advisories are scheduled for November 10, 2026.
Timeline
dated events in the reporting · oldest first- Oct 21, 2026Fortinet vulnerabilities known as of this date · Canadian Centre for Cyber Security
- Oct 22, 2026Fortinet announces coordinated security updates · Cyber Security News
- Oct 23, 2026Canada issues advisory AV26-1081 urging updates · Canadian Centre for Cyber Security
- Nov 10, 2026Public PSIRT advisories scheduled · GBHackers
What each outlet adds
beyond the shared facts- Cyber Security NewsSays Fortinet reports no exploitation and warns of rapid patch-diffing.
- GBHackersCites CISO Carl Windsor on AI-assisted testing and the November 10 PSIRT date.
- Canadian Centre for Cyber SecurityPublishes AV26-1081 and dates the issues as known by October 21.
Coverage
oldest first · one row per article · UTC- · 6d ago
SecurityWeekFirst report
UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
- · 3d ago
Cyber Security News
Fortinet urges urgent patches for FortiOS, FortiManager and FortiAnalyzer
October 22 updates precede November 10 PSIRT advisories; Fortinet reports no active exploitation and lists no CVE IDs.
- · 3d ago
Help Net Security
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
- · 3d ago
GBHackers
Fortinet schedules critical fixes for FortiOS, FortiManager, and FortiAnalyzer
Minimum fixed builds are set for October 22, while PSIRT advisories and CVE details are due November 10.
- · 2d ago
Canadian Centre for Cyber Security
Canadian centre flags Fortinet flaws in six product lines (AV26-1081)
Fixed builds are listed for current branches, while FortiMail 7.2 must move to branch 7.4 or above.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-26008 | An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version… | 5.3 | <1% | ||
| CVE-2024-47575 | Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud | 9.8 | 95% | KEVPoC | KEV |
| CVE-2025-61624 | Authenticated path traversal in Fortinet FortiOS and related products | 6.5 | 1% | KEV | KEV |
CVE-2026-109619+1 related CVE | Use-after-free RCE in PHP via stale request globals | 9.2 | 100% | PoC ×13 | |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 33% | PoC ×16 |