Fortinet patches critical FortiOS, FortiManager, FortiAnalyzer flaws

Key Takeaways

• Fortinet has released urgent security updates for FortiOS, FortiManager, and FortiAnalyzer to address critical and high-severity vulnerabilities.
• These patches, available October 22, were partly discovered through AI-assisted security testing.
• Customers are strongly advised to prioritize patching internet-facing devices immediately due to the risk of AI-powered exploit development.
• Separate, critical vulnerabilities in PHP and Node.js also require immediate attention.

Fortinet is urging its customers to promptly install security updates for FortiOS, FortiManager, and FortiAnalyzer, which became available on October 22. This coordinated release tackles several critical and high-severity vulnerabilities, some of which were identified using cutting-edge AI-assisted security testing methods. The company specifically highlighted the need to prioritize updates for any internet-facing devices.

In an October 21 announcement, Carl Windsor, Fortinet’s Chief Information Security Officer, emphasized that these fixes should not be considered routine maintenance. This latest patching effort follows earlier security releases for FortiMail and FortiAuthenticator, indicating a broader initiative to strengthen the security posture across Fortinet’s product ecosystem.

The Role of AI in Security and Exploitation

Fortinet revealed that its security testing program leverages advanced AI models to scrutinize code paths, protocol handling, and configuration logic for potential weaknesses. The company acknowledged the contributions of Anthropic, OpenAI, Google, and SpaceX for their collaboration with its security teams in this endeavor.

The concern extends beyond merely discovering new flaws. Fortinet issued a stark warning that malicious actors can also utilize AI to conduct “patch diffing”—comparing patched software with older versions to pinpoint code changes and rapidly develop exploits within hours or days. This capability significantly shortens the window of opportunity for defenders to apply updates before vulnerabilities are actively exploited.

Furthermore, AI could enable attackers to chain together multiple lower-severity flaws to construct more impactful attack sequences. While Fortinet’s initial announcement did not include specific CVE identifiers, CVSS scores, or detailed attack conditions for these particular vulnerabilities, nor did it report active exploitation, the urgency remains high.

Fortinet also underscored the importance of human expertise alongside AI. Security analysts play a crucial role in validating AI findings, determining exploitability, distinguishing genuine vulnerabilities from false positives, and recommending product security enhancements.

Affected Versions and Required Updates

Fortinet customers must update their systems to the specified versions to mitigate these vulnerabilities. The updates were made available on October 22, 2026.

FortiOS

Users of FortiOS should upgrade to version 8.0.2, 7.6.8, 7.4.13, or 7.2.14, depending on their existing branch. Affected versions include 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, and 7.2.0–7.2.13.

FortiManager and FortiAnalyzer

For FortiManager and FortiAnalyzer, the minimum fixed releases are 8.0.2, 7.6.8, 7.4.12, and 7.2.13. Vulnerable versions range from 8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.11, and 7.2.0–7.2.12.

FortiMail and FortiAuthenticator

FortiMail users should upgrade to 8.0.2, 7.6.7, or 7.4.9. Customers on affected FortiMail 7.2 releases must migrate to the 7.4 branch or newer. FortiAuthenticator users are advised to install 8.0.4 or 6.6.11, based on their current branch.

Fortinet plans to release comprehensive public advisories on its PSIRT page on November 10. The company notes that FortiSASE will receive automatic updates ahead of the coordinated release. FortiManager Cloud updates may necessitate manual intervention, while updates for public cloud deployments will follow the respective cloud provider’s release procedures.

The strategic delay between firmware availability and full public disclosure is intended to provide customers with a crucial window to upgrade before detailed exploit information becomes widely known. However, this does not imply that exposed devices can safely defer updates until November. Fortinet explicitly urges customers to apply these security updates as soon as they become available, rather than waiting for the technical specifics.

PHP and Node.js Add Patching Pressure

These Fortinet warnings coincide with separate, critical security releases for PHP and Node.js. It is important to note that these are distinct issues and are not confirmed to be components of the Fortinet vulnerabilities.

On October 21, PHP issued emergency patches for CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both vulnerabilities enable remote code execution without authentication. One flaw stems from memory exhaustion leading to incomplete request data, while the other involves stale request states persisting after memory is freed.

The PHP Foundation also acknowledged that AI-assisted research contributed to the investigation of these weaknesses. Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Concurrently, a Node.js security update addresses ten vulnerabilities, with four classified as high severity. CVE-2026-111497, affecting Brotli decompression, could allow code execution via an out-of-bounds memory write. Other high-severity fixes resolve TLS hostname verification bypasses and DNS name truncation issues. The affected supported branches for Node.js are 26.x, 24.x, and 22.x.

What You Should Do

• Prioritize Updates: Immediately identify and apply the recommended security updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, especially for internet-facing devices.
• Backup Configurations: Before initiating any updates, perform full backups of your system configurations.
• Schedule Maintenance: Plan urgent maintenance windows for October 22–23 to implement these critical patches.
• Review Logs: Scrutinize logs for any unusual administrator access or unauthorized configuration changes both before and after applying updates.
• Restrict Management Access: If immediate upgrades are not possible, restrict HTTPS and SSH management interfaces to trusted IP addresses only.
• Secure FortiManager: Remove FortiManager administration interfaces from public internet exposure.
• Enforce MFA: Implement multi-factor authentication (MFA) with unique, strong passwords for all administrative access.
• Update PHP and Node.js: Separately, ensure all PHP installations are updated to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, and Node.js installations on branches 26.x, 24.x, and 22.x are fully patched.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.