FORTINET has issued urgent security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, with FortiMail and FortiAuthenticator fixes arriving a day earlier. The disclosures follow AI-assisted testing that identified critical and high‑severity flaws across these platforms. Fortinet says CVE details will be released on 10 November, and administrators are advised to patch now, treating this as a priority change rather than routine maintenance.
The update applies to FortiOS releases 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and to FortiManager and FortiAnalyzer releases 8.0.2, 7.6.8, 7.4.12 and 7.2.13. Fortinet notes that FortiMail is fixed in 8.0.2, 7.6.7 and 7.4.9, with 7.2 users urged to move to 7.4 or later; FortiAuthenticator is fixed in 8.0.4 and 6.6.11. Fortinet emphasises that FortiSASE updates are automatic, while FortiManager Cloud may require a manual update and public cloud images arrive via cloud partners.
In mitigation, the company advises inventorying all FortiOS and FortiManager devices, scheduling maintenance windows for 22–23 October, backing up configurations, restricting admin access by IP, and keeping MFA enforced, noting these steps reduce risk but do not substitute for a timely upgrade. There is, at present, no public report of exploitation in the wild.