Fortinet Releases Security Hardening Update for FortiOS and Other Products to Address AI-Discovered Vulnerabilities

Key summary

Fortinet has released a security hardening update for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator to address critical and high severity vulnerabilities discovered with the assistance of AI. Details regarding the specific vulnerabilities will not be disclosed until November 10, 2026. The update applies to specific branches: FortiOS, FortiManager, and FortiAnalyzer (8.0, 7.6, 7.4, 7.2); FortiMail (8.0, 7.6, 7.4, with users of 7.2 advised to upgrade to 7.4 or higher); and FortiAuthenticator (8.0, 6.6). Fortinet advises administrators to upgrade immediately without waiting for the disclosure date, prioritizing internet-connected systems. Temporary mitigation measures include restricting administrative access to trusted IP addresses, not exposing FortiManager to the internet, using strong unique credentials, and enforcing MFA for admin accounts. The update does not include fixes for PHP2Shell as the affected products are not impacted by that vulnerability.