Fortinet is asking customers to treat its latest round of updates as an emergency rather than routine maintenance, and is not saying yet what they fix. In a blog post on October 21, Fortinet's Carl Windsor said the company would ship a coordinated security hardening release for FortiOS, FortiManager and FortiAnalyzer on October 22, following updates already out for FortiMail and FortiAuthenticator. The releases include critical and high-severity fixes. CVE numbers and full advisories will only be published on November 10, Fortinet's next Patch Tuesday.
What sets this batch apart is how the bugs were found. Fortinet says the fixes address vulnerabilities identified through its frontier AI-assisted security testing program, in which AI models analyze code paths, protocol handling and configuration logic, and it thanks Anthropic, OpenAI, Google and SpaceX for their collaboration.
Why Fortinet says waiting is the risky option
Fortinet is unusually candid about the downside. It says the same class of AI capability is becoming available to attackers, and gives four reasons for urgency: the fixes include critical and high-severity issues; AI tools can help adversaries reverse-engineer patches and build working exploits in hours or days rather than weeks; the published updates themselves reveal where code changed; and AI can chain lower-severity bugs into a more serious exploitable one. In other words, the clock started when the patches shipped, not on November 10.
The Hong Kong CERT bulletin relaying the release notes that no CVE identifiers or technical details are available yet, and has provisionally rated it medium risk for that reason, pending Fortinet's advisories. Fortinet edge devices are a perennial target, from access brokers to the exploited flaws CISA flagged earlier this month, so the prudent reading is Fortinet's, not the provisional rating.
Move to FortiOS 7.6.8, 7.4.13 or 7.2.14 now
Affected releases and the versions that fix them, per Fortinet:
- FortiOS: 8.0.0 through 8.0.1 (fixed in 8.0.2), 7.6.0 through 7.6.7 (7.6.8), 7.4.0 through 7.4.12 (7.4.13), 7.2.0 through 7.2.13 (7.2.14).
- FortiManager and FortiAnalyzer: 8.0.0 through 8.0.1 (8.0.2), 7.6.0 through 7.6.7 (7.6.8), 7.4.0 through 7.4.11 (7.4.12), 7.2.0 through 7.2.12 (7.2.13).
- FortiMail: 8.0.0 through 8.0.1 (8.0.2), 7.6.0 through 7.6.6 (7.6.7), 7.4.0 through 7.4.8 (7.4.9); 7.2.0 through 7.2.9 should move to the 7.4 branch or later.
- FortiAuthenticator: 8.0.0 through 8.0.3 (8.0.4), 6.6.0 through 6.6.10 (6.6.11).
Fortinet says to prioritize internet-facing devices. Where patching has to wait, it recommends temporary mitigations: manage devices out of band, move resources behind a VPN or SASE where feasible, and apply virtual patches. FortiSASE is updated automatically, FortiManager Cloud may need a manual update, and public cloud images are being pushed through the cloud providers' normal release processes.
If AI-assisted bug hunting is as productive as Fortinet suggests, patch-first, explain-later releases like this one may become the norm across the industry, and the gap between a patch and a working exploit will be measured in days.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.