Fortinet did something a bit unusual this month. On 21 October 2026 they announced a "security hardening release", and on 22 October the fixed builds went live for FortiOS, FortiManager and FortiAnalyzer. FortiMail and FortiAuthenticator were updated in the same round.
The catch: no CVE numbers yet. Fortinet says the fixes include critical and high severity issues, found through their own AI-assisted security testing, and the full advisories will come on their PSIRT page at Patch Tuesday on 10 November.
So why upgrade before you even know the details? Because once the advisories are public, attackers can compare the old and new code and work out the bugs. The best time to patch is before that.
Which version do you need?
| Product | 8.0 | 7.6 | 7.4 | 7.2 |
|---|---|---|---|---|
| FortiOS | 8.0.2 | 7.6.8 | 7.4.13 | 7.2.14 |
| FortiManager | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
| FortiAnalyzer | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
Watch the 7.4 and 7.2 rows: FortiOS needs a different build number from FortiManager and FortiAnalyzer. Easy to mix up when you are planning a maintenance window.
If you are still on FortiOS 7.0, that branch reached end of support on 30 September 2025. Time to plan the jump to a supported branch.
Is anything being exploited?
As of 23 October, there were no reports of exploitation for the issues in this release, and nothing from it in CISA's Known Exploited list. Separately, a FortiMail bug, CVE-2026-104286, is reported as exploited and is in the KEV list, so if you run FortiMail, give it priority.
How I would plan it
- Internet-facing FortiGates first, especially ones with SSL-VPN or admin access exposed.
- Back up the config before every upgrade, and follow Fortinet's upgrade path tool. Don't jump branches blindly.
- FortiManager and FortiAnalyzer next. They should never be reachable from the internet anyway.
- If you can't upgrade this week: restrict HTTPS and SSH admin access to trusted IPs, or turn it off on WAN interfaces, enforce MFA for admins, and keep FortiGuard signatures updated.
- Put 10 November in your calendar and read the advisories when they drop.
Personal view only. Always check Fortinet's release notes and PSIRT advisories for your model and branch.
Comments
No comments yet. Share your own debugging war story.