Fortinet: urgent out-of-band updates, details due in November

On October 22, 2026 Fortinet announced a Security Hardening Release: a batch of updates outside its usual schedule that fixes critical and high-severity vulnerabilities in several products, including FortiOS, FortiManager and FortiAnalyzer. Technical details are not available yet: according to the INCIBE-CERT advisory, the bulletins with CVE identifiers, CVSS scores and the impact of each flaw will be published on November 10, 2026. In the meantime the vendor asks customers to update right away, starting with Internet-facing devices.

What happened

According to CERT.LV and INCIBE-CERT, the vulnerabilities were found during Fortinet’s proactive security reviews of its own products, using AI-assisted testing. Within a day, several national CSIRTs relayed the announcement: the Latvian CERT, Belgium’s CCB (whose headline urges immediate patching), Spain’s INCIBE-CERT, which rates the advisory as importance 5, “critical”, and flags it as preliminary, and the Canadian Centre for Cyber Security with advisory AV26-1081. heise Security describes the updates as urgent and outside the regular cadence.

The list of products is not the same in every source:

• CERT.LV mentions only FortiOS, FortiManager and FortiAnalyzer;
• INCIBE-CERT and the Canadian centre add FortiMail and FortiAuthenticator, with affected and fixed versions;
• INCIBE-CERT notes that the announcement also covers FortiSASE, FortiManager Cloud and public cloud deployments, without listing versions.

None of the sources reports active exploitation of the vulnerabilities so far.

Affected and fixed versions

The versions match in the INCIBE-CERT and Canadian Centre for Cyber Security advisories. Watch the 7.4 branch: for FortiOS the fixed version is 7.4.13, for FortiManager and FortiAnalyzer it is 7.4.12.

Product	Affected versions	Fixed version (or later)
FortiOS	8.0.0–8.0.1 · 7.6.0–7.6.7 · 7.4.0–7.4.12 · 7.2.0–7.2.13	8.0.2 · 7.6.8 · 7.4.13 · 7.2.14
FortiManager and FortiAnalyzer	8.0.0–8.0.1 · 7.6.0–7.6.7 · 7.4.0–7.4.11 · 7.2.0–7.2.12	8.0.2 · 7.6.8 · 7.4.12 · 7.2.13
FortiMail	8.0.0–8.0.1 · 7.6.0–7.6.6 · 7.4.0–7.4.8 · 7.2.0–7.2.9	8.0.2 · 7.6.7 · 7.4.9 · 7.2 branch: no fix
FortiAuthenticator	8.0.0–8.0.3 · 6.6.0–6.6.10	8.0.4 · 6.6.11

There is no fix within the FortiMail 7.2 branch: the Canadian centre advises moving to branch 7.4 or later. For cloud services, INCIBE-CERT reports that FortiSASE will be updated automatically, that FortiManager Cloud may need a manual update, and that public cloud instances should follow the provider’s procedure.

What is known and what is not

The information normally needed to assess risk is still missing: how many vulnerabilities there are, which components they affect, the attack vector, whether authentication is required, the scores. For this reason it is not possible to map MITRE ATT&CK techniques or list indicators of compromise. Two elements, however, help set priorities:

• all the agencies’ recommendations focus on management interfaces reachable over HTTPS and SSH and on administrator accounts;
• INCIBE-CERT explicitly asks not to expose FortiManager to the Internet.

The practical goal is to reach November 10 with devices already updated, as the vendor and the agencies ask, and to review everything again once the bulletins are public.

Impact for European and Italian organisations

The affected products sit at key points of the network: FortiOS runs FortiGate firewalls, often at the boundary between the corporate network and the Internet; FortiManager and FortiAnalyzer centralise their configuration and logs; FortiAuthenticator handles authentication and FortiMail handles email. A critical vulnerability in any of these systems can affect the whole perimeter or the whole fleet of managed devices.

For NIS2 entities, regulated in Italy by Legislative Decree 138/2024, timely vulnerability and patch management is part of the required security measures: it is worth documenting inventory, decisions and remediation times. In healthcare, where firewalls also protect networks with medical devices and clinical systems, updates should be planned in short, closely spaced maintenance windows, without waiting for the November details.

What to do now

1. Take inventory: identify every FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator device and its installed version, including public cloud instances and FortiManager Cloud.
2. Update to the versions in the table, or later ones in the same branch, starting with Internet-facing devices.
3. Back up the configuration before each update, as INCIBE-CERT recommends.
4. If you cannot update right away: restrict access to HTTPS and SSH management interfaces to trusted addresses only, enable multi-factor authentication on administrator accounts and take FortiManager off the Internet.
5. FortiMail 7.2: plan the migration to branch 7.4 or later.
6. Cloud services: check that the automatic FortiSASE update has been applied, verify whether FortiManager Cloud needs manual action and follow the provider’s procedure for public cloud instances.
7. On November 10 read the bulletins: recheck versions and configurations against the published CVEs and review the administrative access logs.

How ARXDOME helps

ARX Sentry has dedicated firewall pages showing firmware status, useful to see at a glance which devices still need updating. ARX Expose shows what your company exposes on the Internet, with open ports and recognised products, and ARX Scout checks the ports and services of your public addresses first-hand, alerting you when a previously closed service opens: together they help you spot a management interface reachable from outside. Finally, ARX Radar flags who is attacking your perimeter right now, for example with brute-force attempts against exposed services.

Last updated: 23 October 2026