Fortinet FortiOS · Disclosed

Fortinet patches critical flaws found with AI; details due November 10

Oct 20, 2026 · 1 min read

Fortinet released security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator fixing flaws rated critical and high severity; according to Fortinet, at least some may be remotely exploitable without prior authentication. Technical details are withheld until November 10, 2026, and the company urges immediate upgrades, prioritizing internet-facing systems. The flaws were found with AI models and validated by humans, and Fortinet warns that AI can link lower-severity flaws into a more severe exploitable one.

By HIFY Radar newsroom Updated 10/26/2026 01:25 PM Get this every day →← Back to the feed 4 sources

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Fortinet published security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Fortinet itself rated the fixed flaws critical and high severity, and at least some may be remotely exploitable without prior authentication. Technical details will only be disclosed on November 10, 2026.

Why it matters

Fortinet devices are a favorite target for attackers, and Fortinet warns that unpatched systems become easier targets once fixes are public. Internet-facing firewalls and managers carry the greatest risk. According to Fortinet's CISO, the window between disclosure and exploitation keeps shrinking.

What to do

Upgrade now to the fixed builds (FortiOS 8.0.2, 7.6.8, 7.4.13 or 7.2.14, and the equivalents for the other products), prioritizing internet-facing systems. In the meantime, restrict admin access to trusted IPs, keep FortiManager off the internet, use strong unique credentials and enforce MFA; these measures are no substitute for upgrading.

For the technical team

Affected: Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator · FortiOS 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, 7.2.0–7.2.13; FortiManager and FortiAnalyzer 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, 7.2.0–7.2.12; FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, 7.2.0–7.2.9; FortiAuthenticator 8.0.0–8.0.3, 6.6.0–6.6.10.
Exploitation: No exploitation reported in the sources and no public PoC for the new flaws. Fortinet showed that AI models can compare firmware versions and build PoCs for already-fixed vulnerabilities, and asks customers to upgrade before November 10, 2026.
Fix: FortiOS 8.0.2, 7.6.8, 7.4.13, 7.2.14; FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12, 7.2.13; FortiMail 8.0.2, 7.6.7, 7.4.9 (7.2 users must move to 7.4 or later); FortiAuthenticator 8.0.4, 6.6.11. Temporary mitigation cited by Fortinet: limit admin access to trusted IP addresses, keep FortiManager off the internet, strong unique credentials and MFA for admin accounts.
Vector: Exact component and flaw type not disclosed; Fortinet is withholding details until November 10, 2026. Fortinet rated the vulnerabilities critical and high severity; by those ratings, at least some may be remotely exploitable without prior authentication (Help Net Security analysis). Fortinet warns that AI can chain lower-severity flaws into a more severe exploitable vulnerability.
More details: Flaws found with frontier AI models plus Fortinet's own on-premises models, validated by humans, according to Fortinet CISO Carl Windsor. Tests without source code access analyzed firmware the way an attacker would, verified through penetration testing and red teaming; the bulk of findings came from pointing the models at Fortinet's own source code. More than 100 tests across 30 product families: about 40% real vulnerabilities, 30% false positives, 30% non-exploitable security improvements. Fortinet disclosure on October 21, 2026; Help Net Security article on October 26, 2026. The hardening updates do not fix the PHP2Shell vulnerabilities: the products in this advisory are not affected by them.