Fortinet ships FortiOS fixes for AI-found flaws, details on 10 November

Fortinet ships FortiOS fixes for AI-found flaws, details on 10 November

22 October 2026: Fortinet has released what it calls a security hardening release for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, fixing critical and high-severity bugs that its AI-assisted security testing found. It is not saying what the bugs are until its next Patch Tuesday on 10 November, and asks customers to upgrade now, starting with internet-facing devices, rather than wait for the details.

Not yet independently verified. Fortinet has not yet published CVE numbers, severity scores or descriptions for these fixes; it says the advisories will appear on its PSIRT page on 10 November, and none of the flaws is reported as exploited. We will update this when it can be confirmed, and remove this note.

Fixed versions

Product	Branch	Fixed in
FortiOS	8.0, 7.6, 7.4, 7.2	8.0.2, 7.6.8, 7.4.13, 7.2.14
FortiManager	8.0, 7.6, 7.4, 7.2	8.0.2, 7.6.8, 7.4.12, 7.2.13
FortiAnalyzer	8.0, 7.6, 7.4, 7.2	8.0.2, 7.6.8, 7.4.12, 7.2.13
FortiMail	8.0, 7.6, 7.4	8.0.2, 7.6.7, 7.4.9 (7.2 users move to 7.4 or later)
FortiAuthenticator	8.0, 6.6	8.0.4, 6.6.11

FortiMail and FortiAuthenticator builds came out on 21 October, the others on 22 October. FortiSASE was updated automatically; FortiManager Cloud has the update but may need a manual upgrade, and instances in public cloud marketplaces follow each provider's release process.

Why Fortinet is asking for urgency without details

Fortinet says it now runs frontier AI models across code paths, protocol handling and configuration logic as part of product security testing, and thanks several AI developers and SpaceX for their collaboration. Its chief information security officer, Carl Windsor, is explicit about the downside: the same capability is reaching attackers, and "AI tools can now help adversaries reverse-engineer patches and build working exploits in hours or days, rather than weeks." Once the fixed builds are public, comparing them with the old ones reveals where the weaknesses were, so unpatched devices become easier targets even before any advisory is written. AI can also chain several lower-severity bugs into one exploitable path.

That is the reasoning behind publishing fixes first and descriptions later. For defenders it means the usual triage, reading the CVSS score and deciding how fast to move, is not available for three weeks.

Interim steps Fortinet recommends

• manage devices out of band, and keep FortiManager administration off the internet;
• restrict administrative HTTPS and SSH to trusted addresses, and require multi-factor authentication;
• move exposed resources behind VPN or SASE where possible, and apply virtual patches until upgrades are done;
• back up configurations before upgrading.

Hong Kong's HKCERT has issued a bulletin on the release with a provisional medium rating, pending the details. This release is separate from the SQL injection fixes in FortiAnalyzer, FortiManager and FortiMail published earlier in October.

Sources

• Fortinet CISO Collective: Fortinet Releases Security Hardening Release for Multiple Products, 21 October 2026
• HKCERT: Fortinet products multiple vulnerabilities, 23 October 2026