Fortinet has urged customers to treat its October security release as a priority change, not routine maintenance, after shipping fixes for critical and high-severity flaws across FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. The unusual part is the timing of the detail: Fortinet will not publish the individual advisories, with CVE identifiers and severity scores, until 10 November 2026. Until then, the fixed build numbers are the main public guide to whether a device is protected.

Fortinet's chief information security officer, Carl Windsor, said on 21 October that the releases include flaws found through its frontier AI-assisted testing programme, which examines code paths, protocol handling and configuration logic. The company thanked Anthropic, OpenAI, Google and SpaceX for collaboration on that testing effort.

Fixed builds to install now

FortiOS fixes are in 8.0.2, 7.6.8, 7.4.13 and 7.2.14. FortiManager and FortiAnalyzer fixes are in 8.0.2, 7.6.8, 7.4.12 and 7.2.13. FortiMail fixes are in 8.0.2, 7.6.7 and 7.4.9, with the 7.2 branch required to move to 7.4 or later. FortiAuthenticator fixes are in 8.0.4 or above on the 8.0 branch and 6.6.11 or above on the 6.6 branch. FortiSASE is updated automatically by Fortinet, while FortiManager Cloud updates may need manual action.

Why waiting for the CVEs is risky

Fortinet reports no in-the-wild exploitation of these newly fixed flaws and no public proof of concept, because no technical details have been published. That protection is temporary: once firmware is public, attackers can compare patched and unpatched code, identify the changed areas and build exploits within hours or days. Internet-facing devices should be patched first, and where patching must wait, administrators should restrict management access to trusted addresses, keep FortiManager off the internet and enforce multi-factor authentication as interim controls only.