Fortinet: Critical updates for FortiOS, FortiManager and others
Key points at a glance
Critical and highly critical fixes for five Fortinet products.
Fortinet recommends treating the update as a priority fix, not as routine maintenance.
Devices exposed to the internet first.
Those unable to patch immediately should restrict admin access.
What has happened?
Fortinet has scanned its products for vulnerabilities using AI models and identified several flaws. The fixes are now being released as a bundle. Fortinet will only disclose exactly which vulnerabilities are being patched on 10 November via the PSIRT page.
Why you shouldn’t wait until 10 November
Fortinet itself cites four reasons:
Severity: The updates contain critical and highly critical fixes.
Faster exploits: Using AI, attackers can analyse patches within hours or days and build attacks based on them.
Patch diffing: As soon as an update is made public, comparing it with the old version reveals where the vulnerability lay.
Chaining: AI can combine several minor vulnerabilities to create a serious attack.
Fixed versions
Product | Affected | Fixed as of | Available |
|---|---|---|---|
FortiOS 8.0 | 8.0.0 to 8.0.1 | 8.0.2 | 22 October |
FortiOS 7.6 | 7.6.0 to 7.6.7 | 7.6.8 | 22 October |
FortiOS 7.4 | 7.4.0 to 7.4.12 | 7.4.13 | 22 October. |
FortiOS 7.2 | 7.2.0 to 7.2.13 | 7.2.14 | 22 October |
FortiManager 8.0 | 8.0.0 to 8.0.1 | 8.0.2 | 22 October |
FortiManager 7.6 | 7.6.0 to 7.6.7 | 7.6.8 | 22 October |
FortiManager 7.4 | 7.4.0 to 7.4.11 | 7.4.12 | 22 October |
FortiManager 7.2 | 7.2.0 to 7.2.12 | 7.2.13 | 22 October. |
FortiAnalyzer 8.0 | 8.0.0 to 8.0.1 | 8.0.2 | 22 October. |
FortiAnalyzer 7.6 | 7.6.0 to 7.6.7 | 7.6.8 | 22 October |
FortiAnalyzer 7.4 | 7.4.0 to 7.4.11 | 7.4.12 | 22 October |
FortiAnalyzer 7.2 | 7.2.0 to 7.2.12 | 7.2.13 | 22 October |
FortiMail 8.0 | 8.0.0 to 8.0.1 | 8.0.2 | 21 October |
FortiMail 7.6 | 7.6.0 to 7.6.6 | 7.6.7 | 21 October. |
FortiMail 7.4 | 7.4.0 to 7.4.8 | 7.4.9 | 21 October |
FortiMail 7.2 | 7.2.0 to 7.2.9 | Upgrade to 7.4 or later | 21 October |
FortiAuthenticator 8.0 | 8.0.0 to 8.0.3 | 8.0.4 | 21 October |
FortiAuthenticator 6.6 | 6.6.0 to 6.6.10 | 6.6.11 | 21 October |
Special cases: FortiSASE is updated automatically. FortiManager Cloud may require a manual update. Instances in the public cloud are updated via the respective cloud provider.
What you should do now
Take stock: Record all FortiOS, FortiManager and FortiAnalyzer instances, starting with those exposed to the internet.
Schedule a maintenance window: On 22 and 23 October for systems exposed to the internet.
Back up the configuration: Take a backup before every upgrade.
Check logs: Before and after applying the patch, look out for unusual admin access and unauthorised configuration changes.
If you cannot patch immediately
Restrict admin interfaces (HTTPS, SSH) to trusted IP addresses or disable them on external interfaces.
FortiManager must not be accessible from the internet.
MFA for all admin accounts; strong and unique passwords.
Where possible: out-of-band management, resources behind a VPN or SASE, virtual patching.
This reduces the risk but does not replace the update.
Support
Need help with prioritisation or patching? Get in touch with us.
Sources