Fortinet has shipped a coordinated wave of security hardening releases for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, fixing critical and high-severity vulnerabilities that were uncovered with the help of frontier AI models, and it is doing something unusual: the fixes went out on October 22, 2026, but the CVE IDs, CVSS scores and technical advisories will not be published until Fortinet’s next Patch Tuesday on November 10, 2026. The logic is simple and a little unnerving. Fortinet says AI now lets attackers diff a patch and build a working exploit in hours or days, so customers get a head start before the details land. With PHP2Shell dominating last week’s headlines, plenty of FortiGate admins may have missed the memo. Here’s what changed, which builds you need, and why waiting for the advisories is the wrong move.
The Release: Fixes First, Advisories on November 10
In a CISO Collective post dated October 21, Fortinet CISO Carl Windsor told customers to treat the update as “a priority change rather than a routine maintenance cycle.” FortiMail and FortiAuthenticator builds were already out when the post went live, and FortiOS, FortiManager and FortiAnalyzer followed on October 22. Fortinet also said FortiSASE would be updated automatically, FortiManager Cloud releases may need a manual update, and public cloud images are being pushed through the relevant cloud marketplaces.
NHS England’s cyber team flagged the release on October 23, noting that Fortinet is releasing the updates ahead of the detailed vulnerability information specifically “to reduce the risk of rapid exploitation.” Fortinet stresses that the full advisories will appear on its PSIRT page on November 10.
The Builds You Need
Fortinet published the fixed versions for every supported branch. If your gear is below these numbers, it is on the list:
- FortiOS: 8.0.2, 7.6.8, 7.4.13 or 7.2.14 and above
- FortiManager: 8.0.2, 7.6.8, 7.4.12 or 7.2.13 and above
- FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12 or 7.2.13 and above
- FortiMail: 8.0.2, 7.6.7 or 7.4.9 and above; FortiMail 7.2 has no fix in-branch, so those boxes need to move to 7.4 or later
- FortiAuthenticator: 8.0.4 or 6.6.11 and above
One bit of good news: Help Net Security confirmed these hardening releases do not contain PHP2Shell fixes because the listed Fortinet products are not affected by those PHP flaws, so this is a separate job on your patch board.
How AI Found the Flaws, and Why That Cuts Both Ways
Fortinet says it has folded frontier AI models into its product security testing, thanking Anthropic, OpenAI, Google and SpaceX for their collaboration. According to Help Net Security’s breakdown, Fortinet first tested its products the way an outsider would, letting models analyze firmware without source code. That turned up few exploitable bugs, but it showed the models were very good at comparing firmware versions and building proof-of-concept exploits for flaws that had already been fixed. Pointing the models at Fortinet’s own source code produced most of the findings: across more than 100 tests of 30 product families, roughly 40% of findings were real vulnerabilities, 30% were false positives and 30% were hardening opportunities.
That is exactly why Windsor is pushing hard. As he put it, “The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking.” Fortinet lists four reasons to move now:
- Criticality: The releases include critical and high-severity fixes.
- Faster weaponization: AI tools can help adversaries reverse-engineer patches and build exploits in hours or days rather than weeks.
- Patch diffing: “Once updates are public, the fixes themselves reveal where changes were made,” Windsor wrote, making unpatched devices easier targets.
- Chaining: AI can “link seemingly unrelated lower severity vulnerabilities together to achieve a more severe, exploitable vulnerability.”
What IT Pros Should Do Today
Think of the next two weeks as a head start, not a grace period. The binaries are public, which means anyone with a decompiler and a capable model can already start hunting for what changed. A practical plan:
- Inventory: Find every FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator you or your clients run, and flag anything internet-facing first.
- Back up, then upgrade: Save configurations before each upgrade and follow Fortinet’s supported upgrade path for your branch.
- Shrink the attack surface: Restrict HTTPS and SSH admin access to trusted IPs or disable it on external interfaces, and keep FortiManager administration off the internet entirely.
- Lock down admins: Use strong unique credentials and enforce MFA on every administrator account.
- Watch the logs: Look for unusual administrative logins or unapproved configuration changes before and after patching.
Fortinet is clear that those mitigations “reduce risk but do not replace the need for a timely upgrade.” For MSPs juggling dozens of client firewalls, this is a good week to burn some after-hours maintenance windows.
Looking Ahead
Fortinet says the patch-first, details-later approach reflects how it will handle releases going forward, and it will keep applying AI-assisted testing across its portfolio. Expect other network and security vendors to follow suit as AI-driven bug hunting turns up more flaws and shortens the time defenders get between a fix and a working exploit.
Mark November 10 on the calendar. When the advisories drop, attackers and researchers alike will know exactly where to look, and any FortiGate still on an old build will stand out. The teams that upgrade now will spend that Patch Tuesday reading advisories instead of responding to incidents.
Sources:
- Fortinet, October 21, 2026
- NHS England Digital, October 23, 2026
- Help Net Security, October 26, 2026
