Fortinet did something unusual last month. It shipped new firmware for FortiOS, FortiManager and FortiAnalyzer, rated the fixes critical and high, and then said it would not explain what was fixed until 10 November. No CVE numbers, no scores, no descriptions. Just "please upgrade".
I look after FortiGates across offices in three countries, so I read the notice twice. The reason behind the delay is the interesting part: the bugs were found with help from frontier AI models, and Fortinet is worried that the same kind of AI can turn a published fix into a working exploit within hours. Here's what was released, why the details are held back, and what I'd check before the advisories go public.
Quick answer
Upgrade before the advisories publish on 10 November 2026. Reported fixed builds are FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13. Do internet-facing firewalls first. Until you can upgrade, limit admin access to trusted IPs, keep FortiManager off the internet and turn on MFA for admin accounts. Always confirm your exact build on the FortiGuard PSIRT portal and the release notes.
What Fortinet released, and when
Fortinet's CISO, Carl Windsor, announced a "security hardening release" on the Fortinet blog on 21 October 2026. FortiMail and FortiAuthenticator builds came out first, and FortiOS, FortiManager and FortiAnalyzer followed on 22 October. The details are scheduled for Fortinet's next monthly advisory day, which is 10 November.
| Product | Fixed builds (as reported) |
|---|---|
| FortiOS | 8.0.2, 7.6.8, 7.4.13, 7.2.14 |
| FortiManager | 8.0.2, 7.6.8, 7.4.12, 7.2.13 |
| FortiAnalyzer | 8.0.2, 7.6.8, 7.4.12, 7.2.13 |
| FortiMail | 8.0, 7.6 and 7.4 branches (7.2 users should move to 7.4 or later) |
| FortiAuthenticator | 8.0 and 6.6 branches |
The version numbers come from several independent reports, including Help Net Security. They all agree, but I'd still read the release notes for your own model and branch before you schedule anything. Firewalls are not where you want to guess.
Why the details are being held back
Normally a vendor publishes the fix and the advisory together. Fortinet split them on purpose. Its argument is simple: once a patch is public, an attacker can compare the old and new firmware, see exactly which code changed, and work backwards to the bug. With AI doing the comparison, that used to take days and now can take hours. Releasing the fix three weeks early gives customers a head start before anyone knows where to look.
Fortinet also said something I found more worrying. AI is good at chaining several low-severity issues into one serious one. A bug you'd normally ignore could become part of a working attack.
Not everyone likes this approach. Security researchers pointed out that the firmware itself is already public, so attackers can start comparing it now. The head start only helps the people who actually upgrade.
How the bugs were found
This is the part that will matter long after November. According to Fortinet, the flaws came from testing with frontier AI models plus its own on-premises models, with every finding checked by a human. The company thanked Anthropic, OpenAI, Google and SpaceX for working with it on the programme.
Fortinet shared some candid numbers about how it went. Testing without source code found very little that was exploitable. With source code, across more than 100 tests on 30 product families, roughly 40% of findings were real vulnerabilities, 30% were false positives and 30% were improvements that weren't exploitable. So AI didn't replace the security team. It gave them a long list that humans still had to sort.
It fits a pattern. A few days ago I wrote about OpenAI's AI finding 948 Linux kernel bugs. Vendors are now finding bugs faster than ever, which means more patches, more often, for the rest of us to install.
What I'd do before 10 November
- Make a list. Every FortiGate, FortiManager and FortiAnalyzer, its model, current build and whether its admin interface or SSL VPN faces the internet.
- Check the upgrade path. Use Fortinet's upgrade path tool for each model. Jumping several builds at once without the right steps is how firewalls end up in a boot loop.
- Back up the config from each device before touching it. Keep a copy off the device.
- Do internet-facing units first. A firewall at a branch office with a public SSL VPN matters more than a lab box.
- Upgrade FortiManager and FortiAnalyzer before the FortiGates they manage, so the management side understands the new firmware.
- Test after each one. VPN tunnels up, policies passing traffic, logs arriving in FortiAnalyzer.
To confirm the build on a FortiGate from the CLI, and take a backup to a TFTP server first:
get system status | grep -i version
execute backup config tftp fgt-before-upgrade.conf 192.168.0.50If you can't upgrade straight away, Fortinet's own advice is to reduce exposure in the meantime: allow admin access only from trusted IP addresses, keep FortiManager off the public internet, use strong unique passwords and enforce MFA on every admin account. It's clear these steps are a stopgap, not a replacement.
What happens on 10 November
The advisories should appear on the FortiGuard PSIRT portal, with CVE numbers and severity scores. That's when the clock really starts. Anyone who hasn't upgraded by then becomes the easy target, because the fix will point straight at the weakness.
One thing to keep separate: this release does not fix the PHP2Shell flaws that made headlines the same week. Fortinet says its products aren't affected by those (advisory FG-IR-26-186).
A few things worth keeping in mind
- Fortinet hasn't reported attacks on these specific flaws. That can change quickly after the details go public.
- Read the release notes for known issues. A new build sometimes changes a default or breaks an older feature. Check before a production upgrade, not after.
- Schedule a window. A FortiGate reboot drops every session through it. Tell people first.
- Expect this to happen again. If AI-assisted testing keeps finding bugs at this rate, "patch now, details later" may become normal.
If you want an example of how I keep an eye on FortiGates across several sites, my write-up on FortiGate security reporting and audit automation covers it, and one network design for three country offices shows the layout behind it. If you need a hand planning upgrades like this for your office, that's part of my network services.
Frequently asked questions
Which FortiOS version fixes the October 2026 AI-found vulnerabilities?
Reports list FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14 as the fixed builds, released on 22 October 2026. Check the FortiGuard PSIRT advisories on 10 November and your model's release notes to confirm the right build for your branch.
Why did Fortinet delay the vulnerability details until 10 November?
Fortinet says AI can compare patched and unpatched firmware and build an exploit within hours. Releasing the fix first gives customers time to upgrade before the advisories show attackers where to look.
Are these Fortinet vulnerabilities being exploited?
Fortinet had not reported exploitation of these specific flaws as of early November 2026. The risk rises once the details publish, so upgrade internet-facing devices first.
What should I do if I cannot upgrade my FortiGate yet?
Limit admin access to trusted IP addresses, keep FortiManager off the internet, use strong unique passwords and enforce MFA on admin accounts. Fortinet says these reduce exposure but do not replace upgrading.
Should I upgrade FortiManager or FortiGate first?
Upgrade FortiManager and FortiAnalyzer first, so they support the newer FortiOS build, then the FortiGates they manage. Back up every configuration and follow Fortinet's upgrade path tool for each model.