Artemy Kirnichansky If you run a FortiGate firewall, FortiManager, FortiAnalyzer, FortiMail or FortiAuthenticator, Fortinet is asking you to upgrade this week, and to treat it as an emergency change rather than routine maintenance. The updates for FortiOS, FortiManager and FortiAnalyzer ship on October 22, 2026; FortiMail and FortiAuthenticator fixes are already out.
This post covers which versions are affected, the order to upgrade in, and what to lock down today if you cannot upgrade yet.
The short answer: Fortinet’s October 2026 security hardening release fixes critical and high-severity flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, found through AI-assisted security testing. Upgrade internet-facing devices first, ideally by October 23. Until then, restrict admin interfaces to trusted IP addresses, keep FortiManager off the internet, and enforce MFA on every admin account.
Fortinet has not published the CVE details yet; they arrive on November 10. That gap is the risk. Attackers can compare old and new firmware to find the flaws, and Fortinet itself warns that AI lets them build working exploits “in hours or days, rather than weeks.” Patch before the details go public.
Security hardening release
A security hardening release is a coordinated set of firmware updates that fixes multiple vulnerabilities across several products at once. Fortinet ships the fixes first and publishes the detailed advisories later, giving customers a head start to patch before attackers learn exactly what was fixed.
What is in Fortinet’s October 2026 security release?
It is a batch of critical and high-severity fixes across five Fortinet products, announced by Fortinet CISO Carl Windsor on October 21, 2026. Fortinet found the issues by adding frontier AI models to its own product security testing, analyzing code paths, protocol handling and configuration logic.
Fortinet has not listed CVE numbers or individual severity scores. Full advisories will be published on the FortiGuard PSIRT page at the next Patch Tuesday, November 10. As of release, Fortinet has not reported any of these flaws being exploited.
As a Fortinet Advanced Partner (and a Fortinet partner since 2003), we read the wording here as unusually direct. Fortinet is asking customers to schedule change windows for October 22 and 23 on internet-facing systems. Vendors do not usually set the calendar for you.
Which Fortinet versions are affected?
Every supported branch of the five products is affected. Find your product and branch below and upgrade to the fixed version or later.
| Product | Affected | Upgrade to | Available |
|---|---|---|---|
| FortiOS 8.0 | 8.0.0 to 8.0.1 | 8.0.2+ | Oct 22 |
| FortiOS 7.6 | 7.6.0 to 7.6.7 | 7.6.8+ | Oct 22 |
| FortiOS 7.4 | 7.4.0 to 7.4.12 | 7.4.13+ | Oct 22 |
| FortiOS 7.2 | 7.2.0 to 7.2.13 | 7.2.14+ | Oct 22 |
| FortiManager 8.0 | 8.0.0 to 8.0.1 | 8.0.2+ | Oct 22 |
| FortiManager 7.6 | 7.6.0 to 7.6.7 | 7.6.8+ | Oct 22 |
| FortiManager 7.4 | 7.4.0 to 7.4.11 | 7.4.12+ | Oct 22 |
| FortiManager 7.2 | 7.2.0 to 7.2.12 | 7.2.13+ | Oct 22 |
| FortiAnalyzer 8.0 | 8.0.0 to 8.0.1 | 8.0.2+ | Oct 22 |
| FortiAnalyzer 7.6 | 7.6.0 to 7.6.7 | 7.6.8+ | Oct 22 |
| FortiAnalyzer 7.4 | 7.4.0 to 7.4.11 | 7.4.12+ | Oct 22 |
| FortiAnalyzer 7.2 | 7.2.0 to 7.2.12 | 7.2.13+ | Oct 22 |
| FortiMail 8.0 | 8.0.0 to 8.0.1 | 8.0.2+ | Oct 21 |
| FortiMail 7.6 | 7.6.0 to 7.6.6 | 7.6.7+ | Oct 21 |
| FortiMail 7.4 | 7.4.0 to 7.4.8 | 7.4.9+ | Oct 21 |
| FortiMail 7.2 | 7.2.0 to 7.2.9 | Move to 7.4 or later | Oct 21 |
| FortiAuthenticator 8.0 | 8.0.0 to 8.0.3 | 8.0.4+ | Oct 21 |
| FortiAuthenticator 6.6 | 6.6.0 to 6.6.10 | 6.6.11+ | Oct 21 |
Cloud services are mostly handled for you. FortiSASE was updated automatically before release. FortiManager Cloud has the update available but may need a manual update. Public cloud instances are being updated through the cloud providers’ normal release processes, so check yours rather than assume.
Running FortiOS 7.0 or older, or FortiMail 7.2? There is no fix on your branch in this release. That puts you on a forced upgrade, and possibly a hardware conversation if your model cannot run a supported version. We covered the trade-offs in the real cost of running outdated FortiGate models.
Why is Fortinet treating this as urgent?
Because once a patch ships, the clock starts for attackers too. Firmware fixes can be reverse-engineered to reveal what was broken, and Fortinet says AI now helps attackers turn that into a working exploit in hours or days. It also warns that AI can chain several lower-severity flaws into one serious attack.
We are seeing the same pattern elsewhere this week. The PHP2Shell vulnerability disclosed on October 21 was turned into a working exploit with AI help, and attackers were testing it before the patch shipped. Firewalls and management consoles are an even more attractive target, because they sit on the edge of the network and hold the keys to everything behind them.
Nov 10
Date Fortinet publishes the full advisories. Every day before then is a head start for defenders (Fortinet, October 2026)
How should you roll out the Fortinet updates?
Inventory, back up, upgrade the internet-facing devices first, then watch the logs. This is the order we follow when we run a coordinated Fortinet upgrade for a client, and it matches Fortinet’s own guidance.
List every device: record every FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, its current version, and whether its admin interface can be reached from the internet. Branch-office and lab devices are the ones most often forgotten.
Back up configurations: take a fresh config backup of every device before you touch it, and store it off the device.
Check the upgrade path: FortiOS often needs intermediate versions when you jump several builds. Use Fortinet’s upgrade path tool so a firewall does not come back with a broken config.
Upgrade internet-facing devices first: perimeter FortiGates, VPN gateways, FortiMail and anything with an admin interface exposed. For HA pairs, follow the normal cluster upgrade process to keep traffic flowing.
Review logs before and after: look for admin logins from unfamiliar IP addresses, new admin accounts, or configuration changes nobody approved. Upgrading does not remove an attacker who is already in.
Upgrade FortiManager and FortiAnalyzer before the FortiGates they manage. A management console running an older version than its firewalls can stop pushing policies or receiving logs, and you will find out at the worst moment.
What should you do if you cannot upgrade today?
Shrink who can reach your admin interfaces. Fortinet lists these temporary steps, and stresses they reduce risk but do not replace the upgrade:
- Limit HTTPS and SSH admin access to trusted IP addresses, or turn admin access off on external interfaces entirely.
- Make sure FortiManager cannot be reached from the internet.
- Manage devices out of band, and move management behind a VPN or SASE where you can.
- Use strong, unique passwords and enforce MFA for every admin account.
If those steps sound familiar, they should. Exposed admin interfaces and reused admin credentials were at the centre of the FortiBleed credential leak, and they are the first things we close on any firewall we take over. Getting them right now protects you against this release and the next one.
What this means for your patching process
A firewall patch that waits for next month’s maintenance window is now a gamble. If your team cannot upgrade every perimeter device within a day or two of a critical release, the gap is in the process, not the people: an incomplete inventory, no tested upgrade path, or no one with time set aside. We wrote about that problem in depth in FortiGate CVEs and the patch management problem.
Upgrade internet-facing Fortinet devices by October 23, management consoles first. Lock down admin access in the meantime, and check logs for unexpected admin activity. Then fix whatever made this upgrade hard, because the next one will be just as urgent.
If you would rather not run this upgrade under pressure, our managed firewall team handles Fortinet upgrades, admin lockdown and log review for organizations across the GTA and BC. We have been a Fortinet partner since 2003, and coordinated releases like this one are routine work for us.
Sources
- Fortinet Releases Security Hardening Release for Multiple Products, Fortinet, 2026
- FortiGuard PSIRT Advisories, Fortinet
- Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer, SecurityOnline, 2026
- Upgrade Path Tool, Fortinet Documentation
Maxim Kazachek 
Paul Thresher 