Fortinet is releasing security updates for FortiOS, FortiManager and FortiAnalyzer today, 22 October 2026. They follow updates for FortiMail and FortiAuthenticator that are already available. Fortinet has asked every customer to upgrade as soon as the new versions are available, starting with devices that can be reached from the internet. We will update this article when Fortinet publishes the release notes.
The updates fix vulnerabilities that Fortinet found through its own AI-assisted security testing. Fortinet says the releases include critical and high-severity fixes. It has not yet published the details of each vulnerability. Those will appear on the FortiGuard PSIRT advisory page on 10 November 2026, Fortinet’s next monthly Patch Tuesday.
This guide explains which versions you need, the order to upgrade in, and what to do if you cannot upgrade straight away.
Why this release needs prompt action
Fortinet has asked customers to treat this release as a priority change, not routine maintenance. It gives four reasons.
First, the releases contain critical and high-severity fixes. Second, attackers are using AI tools to build exploits faster. FortiGuard Labs reports that attackers can exploit critical outbreaks in as little as 24 to 48 hours. Its earlier research put the average at 4.76 days. Third, once new firmware is published, attackers can compare the old and new versions to find what was fixed, a technique known as patch diffing. Fourth, AI tools make it easier to combine several lower-severity flaws into one serious attack.
Fortinet is holding back the details until 10 November to give customers time to upgrade. That time shrinks once attackers start analysing the new firmware, so the safest approach is to finish upgrading well before the advisories are published.
Fixed versions
Find your product and version branch below. If your device runs an earlier version in that branch, it needs to be upgraded.
| Product | 8.0 | 7.6 | 7.4 | 7.2 |
|---|---|---|---|---|
| FortiOS | 8.0.2 | 7.6.8 | 7.4.13 | 7.2.14 |
| FortiManager | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
| FortiAnalyzer | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
| FortiMail | 8.0.2 | 7.6.7 | 7.4.9 | Move to 7.4 or later |
FortiAuthenticator is fixed in 8.0.4 for the 8.0 branch and 6.6.11 for the 6.6 branch.
For cloud services, FortiSASE is updated automatically by Fortinet, and FortiManager Cloud may need a manual update. Public cloud instances receive the updates through Fortinet’s cloud partners, following their standard release process.
These versions are also later than the FortiManager and FortiAnalyzer fixes Fortinet published on 13 October 2026, so upgrading covers those as well. Fortinet has not included other products, such as FortiProxy or FortiWeb, in this release.
FortiMail: act now
FortiMail customers should treat this as urgent. The fixed FortiMail versions above also fix CVE-2026-104286, a critical vulnerability (CVSS 9.8) that Fortinet confirmed was exploited in the wild. It allows an attacker to write files to the appliance without logging in, using crafted web requests. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalogue on 1 October 2026.
Upgrade FortiMail to 8.0.2, 7.6.7 or 7.4.9. If you run 7.2, move to the 7.4 branch or later. Fortinet fixed this vulnerability in FortiMail Cloud on 5 October, so FortiMail Cloud customers need no action for CVE-2026-104286.
If you cannot upgrade immediately, Fortinet’s advisory (FG-IR-26-175) gives three workarounds:
- turn off IBE (Identity-Based Encryption) under Encryption > IBE;
- make the FortiMail webmail interface unreachable from the internet, or limit it to trusted networks;
- on any web application firewall in front of FortiMail, block POST requests to
/ibethat contain../.
Because this flaw was exploited before a fix was available, also check upgraded appliances for signs of compromise. The advisory lists these indicators:
- connections involving the IP addresses 79.141.169.187 and 45.129.0.192;
- an archive account named
archive234set to send data to a remote server; - a root cron job that runs a command referring to
/migadmin; - IBE errors in the encryption logs reporting “Invalid Base64 Encoding”.
If you find any of these, treat the appliance as compromised, start your incident response process and reset administrator credentials. Our email security services page explains how we monitor and manage mail gateways.
How to plan the upgrade
1. List your devices. Record every FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with its current version and whether its management interface or services can be reached from the internet. Start with those that can.
2. Back up configurations. Take a configuration backup of each device before upgrading, and store it off the device.
3. Check the upgrade path. Some upgrades must pass through intermediate versions. Use Fortinet’s upgrade path tool and read the release notes for your target version, including the known issues.
4. Upgrade in the right order. Fortinet’s release notes recommend upgrading the devices that manage others first: FortiAnalyzer, then FortiManager, then FortiGate devices, then managed FortiExtender, FortiSwitch and FortiAP devices. This keeps the management devices able to support the FortiOS version your FortiGates move to. Check Fortinet’s compatibility information for FortiManager and FortiAnalyzer to confirm which FortiOS versions each release supports.
5. Upgrade HA clusters carefully. FortiGate high-availability clusters can be upgraded with minimal disruption. Confirm the cluster is in sync before you start, and check that both units run the new version afterwards.
6. Watch the logs. Before and after the upgrade, review logs for administrator logins from unexpected locations, new administrator accounts and unapproved configuration changes. Fortinet recommends this step specifically.
Fortinet suggested maintenance windows on 22 and 23 October for internet-facing systems. If you have not upgraded yet, schedule it as soon as you can.
If you cannot upgrade this week
Some organisations need more time because of change freezes, testing or older hardware. In that case, reduce exposure until the upgrade is done. Fortinet recommends the following:
- limit HTTPS and SSH administrative access to trusted IP addresses, or turn it off on internet-facing interfaces;
- make sure FortiManager cannot be reached from the internet;
- manage devices through a separate management network where possible;
- move internal resources behind VPN or SASE access;
- apply virtual patches where they are available;
- use strong, unique passwords and multi-factor authentication for every administrator account.
Fortinet is clear that these steps reduce risk but do not replace the upgrade.
Devices on older versions
The fixed version table does not include FortiOS 7.0. FortiOS 7.0 reached end of support on 30 September 2025, and standard 7.0 firmware no longer receives security fixes. FortiGates still on 7.0 should move to a supported branch.
FortiOS 7.2 reached end of support on 30 September 2026, according to Fortinet’s product life cycle. This release still includes a 7.2 fix (7.2.14), so install it now, then plan to move 7.2 devices to 7.4 or 7.6 soon so they keep receiving security fixes.
Some older FortiGate models cannot run newer branches. If your hardware is limited to a version that is no longer supported, plan its replacement. Our article on FortiBleed covers other steps for organisations running Fortinet firewalls.
What happens on 10 November
On 10 November 2026, Fortinet will publish the full advisories for these vulnerabilities on its PSIRT page, including CVE numbers, severity scores and the affected features. We will update this article when they are released. Devices that have not been upgraded by then face higher risk, because the published details make the vulnerabilities easier to exploit.
How iConnect can help
Frequently asked questions
What did Fortinet release in October 2026?
Fortinet is releasing security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, after earlier updates for FortiMail and FortiAuthenticator. The updates fix critical and high-severity vulnerabilities that Fortinet found through AI-assisted security testing.
Which FortiOS versions fix the vulnerabilities?
FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, or later versions in each branch.
Are the vulnerabilities being exploited?
Fortinet has not said whether the FortiOS, FortiManager or FortiAnalyzer vulnerabilities are being exploited. The FortiMail vulnerability CVE-2026-104286, fixed in the same FortiMail versions, was exploited before a fix was available.
When will Fortinet publish the CVE details?
On 10 November 2026, on the FortiGuard PSIRT advisory page.
Do cloud-hosted Fortinet services need updating?
Fortinet updates FortiSASE automatically. FortiManager Cloud may need a manual update, and public cloud instances are updated through Fortinet's cloud partners. For FortiMail Cloud, Fortinet fixed CVE-2026-104286 on 5 October 2026.
What if I cannot upgrade immediately?
Restrict administrative access to trusted IP addresses, keep FortiManager off the internet, enforce multi-factor authentication for administrators and apply virtual patches where available. Then upgrade as soon as possible.
This article is based on Fortinet’s published guidance as of 22 October 2026 and will be updated when Fortinet releases its advisories on 10 November 2026.
