Fortinet Security Hardening Release: Upgrade FortiOS, FortiManager and FortiAnalyzer Now, Advisories Due 10 November

Fortinet released a coordinated set of security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, following updates for FortiMail and FortiAuthenticator. In a 21 October post, Fortinet CISO Carl Windsor said the releases "include critical and high-severity fixes" and asked customers to treat them "as a priority change rather than a routine maintenance cycle". Fortinet has not yet published CVE IDs, CVSS scores or individual advisories. It says those will follow on its PSIRT page at Patch Tuesday on 10 November.

That leaves a gap. Fortinet warns that once updates are public, attackers can study what changed. Defenders, meanwhile, only have a version table and a deadline. As of 23 October 2026, 07:26 Cyprus time (UTC+3), neither Fortinet nor any national CERT we checked reports exploitation of the issues fixed in this release, and CISA's Known Exploited Vulnerabilities (KEV) catalog has no entry for it.

Technical Information

What Fortinet has said (Fortinet CISO Collective blog, 21 October 2026):

• The releases include "fixes to address vulnerabilities identified through our frontier AI-assisted security testing program."
• "These releases include critical and high-severity fixes."
• "We strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices."
• Fortinet gives four reasons for the urgency: the severity of the fixes; that "AI tools can now help adversaries reverse-engineer patches and build working exploits in hours or days, rather than weeks"; that patches show where changes were made, so "unpatched devices then become easier targets for attackers"; and that AI can help chain lower-severity flaws into a more serious one.
• Fortinet says "public advisories will be made available at the next Patch Tuesday on November 10", on the Fortinet PSIRT page.
• FortiSASE was to be updated automatically before 22 October. FortiManager Cloud releases were to be available by 22 October "but may require manual update". Public cloud instances are being updated through the cloud partners' normal release processes.

What is not known yet:

• Which vulnerabilities were fixed, in which components, and whether exploiting them needs authentication or access to a management interface.
• CVE IDs, CVSS scores and Fortinet's per-issue severity. As of 07:25 Cyprus time on 23 October, the Fortinet PSIRT page has no advisory for this release. The latest entry is dated 21 October and covers an unrelated issue.
• The release notes for the fixed FortiOS, FortiManager and FortiAnalyzer versions (all dated 22 October in their change logs) do not identify the hardening fixes by CVE.

Timeline (dates as published; times in Cyprus time, UTC+3, where the source gives one):

• 21 October 2026: Fortinet publishes the CISO Collective post announcing the release. It lists the FortiMail and FortiAuthenticator fixed versions as available "Today".
• 21 October, 17:33 (16:33 Danish time): Denmark's DKCERT relays the announcement. It reports that Fortinet describes the updates as urgent and that technical details will be published on 10 November through Fortinet's PSIRT.
• 22 October: Release notes for FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and for FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13, appear in the Fortinet Document Library, each with a change-log date of 22 October.
• 22 October: The Centre for Cybersecurity Belgium (CCB) publishes a warning. It lists CVE identifiers and CVSS scores as "Not yet publicly disclosed" and recommends installing the updates "with the highest priority after thorough testing".
• 10 November (planned): Fortinet publishes the public advisories.

A separate FortiMail issue to keep in mind. The FortiMail fixed versions in Fortinet's hardening table (8.0.2, 7.6.7 and 7.4.9; 7.2 users move to 7.4 or later) match the fixed versions Fortinet lists in its separate FortiMail advisory FG-IR-26-175. That advisory was published on 1 October, and Fortinet says the flaw "has been reported to be exploited in the wild". CISA added that flaw to the KEV catalog on 1 October. Fortinet has not said how the FortiMail hardening fixes relate to that flaw, and we do not assume a link. What is established is narrower: a FortiMail appliance below these versions is also missing Fortinet's fix for that flaw. Fortinet says it remediated FortiMail Cloud for that flaw on 5 October and that FortiMail Cloud customers "need not perform any action". We covered that flaw in our earlier FortiMail advisory.

Affected Product Versions

Per Fortinet's table (21 October 2026). Fortinet says "or above" for every fixed version.

Notes:

• Look-alike numbers. On the 7.4 and 7.2 branches, FortiOS and FortiManager/FortiAnalyzer have different fixed versions: 7.4.13 and 7.2.14 for FortiOS, but 7.4.12 and 7.2.13 for FortiManager and FortiAnalyzer.
• Release-note dates. Every fixed version above has release notes in the Fortinet Document Library. The change logs date FortiMail 7.6.7 to 2 October, FortiMail 8.0.2 and 7.4.9 to 3 October, FortiAuthenticator 6.6.11 to 7 October and FortiAuthenticator 8.0.4 to 22 October. Fortinet's post calls these "recent releases". Some FortiMail and FortiAuthenticator estates may already be on a fixed version.
• Branches not listed. Fortinet's table covers the 8.0, 7.6, 7.4 and 7.2 branches (6.6 and 8.0 for FortiAuthenticator) and does not mention older ones. For FortiOS 7.0, a Fortinet support article gives the End of Support date as 2025-09-30 (Fortinet Community). Rescana guidance: if you still run 7.0 or another older branch, plan a move to one of the branches in the table, and confirm with Fortinet support or your account team if you have a separate support arrangement for it.

Workaround and Mitigation

1. Upgrade. Move every affected device to the fixed version for its branch, or later. Fortinet asks customers to start with internet-facing devices and suggested scheduling change windows for 22–23 October. Fortinet's preparation steps:

• "Identify every FortiManager device and FortiOS instance, prioritizing those that are exposed to the internet"
• "Save current configurations before upgrading"
• "Watch logs for unusual administrative access or unapproved configuration changes before and after patching"

For FortiManager Cloud, check whether you need to apply the update manually. For public cloud instances, follow your cloud provider's release process.

2. If you cannot upgrade immediately, Fortinet recommends cutting exposure in the meantime:

• "Restricting administrative interfaces (HTTPS, SSH) to trusted IP addresses or disable them on external interfaces"
• "Ensuring FortiManager administration is not reachable from the internet"
• Managing devices out of band, and moving resources behind VPN or SASE where feasible
• Applying virtual patches until patching can be prioritized
• Using strong, unique credentials and enforcing MFA for all administrator accounts

Fortinet adds: "These steps reduce risk but do not replace the need for a timely upgrade." CCB gives the same advice and adds that patching "does not remediate historic compromise". Investigate any suspicious activity you find before or after the upgrade.

3. FortiMail. If any FortiMail appliance is below 8.0.2, 7.6.7 or 7.4.9, or is still on 7.2, deal with it first (Rescana guidance). Fortinet lists those versions as the fix for CVE-2026-104286, which it says "has been reported to be exploited in the wild". Fortinet's workaround and indicators for that CVE are in FG-IR-26-175.

Indicators of Compromise

Fortinet, DKCERT and CCB have published no indicators of compromise for the hardening release. With no CVE IDs and no reported exploitation, there is nothing specific to hunt for yet. Fortinet's monitoring advice is general: watch for unusual administrative access and unapproved configuration changes. CCB adds new administrator accounts and changes to access policies or management settings. Neither source maps the release to MITRE ATT&CK, and we have not done so either.

The only Fortinet indicators that touch these product versions belong to CVE-2026-104286 (FortiMail). They are published in FG-IR-26-175 and Fortinet has not linked them to the hardening release.

What we will update

We will update this post when Fortinet publishes the advisories and CVE details, which it plans to do on 10 November. We will update sooner if CISA or a national CERT reports exploitation of any of the fixed issues, or if CISA adds a related entry to the KEV catalog.

Sources

• Fortinet: CISO Collective, Carl Windsor, "Fortinet Releases Security Hardening Release for Multiple Products" (21 October 2026); release notes in the Fortinet Document Library, for example FortiOS 8.0.2, FortiManager 8.0.2, FortiAnalyzer 8.0.2, FortiMail 8.0.2 and FortiAuthenticator 8.0.4; PSIRT advisories, including FG-IR-26-175 (FortiMail, CVE-2026-104286; published 1 October 2026, updated 7 October 2026); Fortinet Community support article (FortiOS 7.0 End of Support date)
• DKCERT: "Fortinet advarer om kritiske sikkerhedsrettelser" (21 October 2026, Danish)
• Centre for Cybersecurity Belgium: "Warning: Fortinet Releases Critical Security Hardening Updates for Multiple Products, Patch Immediately!" (22 October 2026)
• CISA: Known Exploited Vulnerabilities catalog (checked 23 October 2026, 07:25 Cyprus time; catalog version 2026.10.21), including the CVE-2026-104286 entry

Fortinet devices sit at the edge of many suppliers' and MSPs' networks, and FortiManager often manages whole fleets of them. For vendor risk, the useful signal is whether your key suppliers act on a vendor's upgrade call when there are no CVE IDs to track yet, not only once the advisories arrive.

Forward this to your TPRM owner: Running Fortinet does not mean a supplier is exposed, but a short, friendly check is worth it. Ask your key suppliers and MSPs this week whether they run FortiOS, FortiManager, FortiAnalyzer, FortiMail or FortiAuthenticator (including on infrastructure they operate for you), whether any administrative interfaces are reachable from the internet, whether they are on Fortinet's fixed versions (for FortiMail, 8.0.2, 7.6.7 or 7.4.9 or later), and if not, when they plan to upgrade and what interim restrictions are in place (Rescana guidance).

Want a fast, evidence-based view of which vendors in your supply chain run exposed edge devices like these, and how quickly they respond? Book a demo.