Fortinet urgent update: bugs found with AI help, CERT-In says patch now
CERT-In says Fortinet's new security release is an emergency change. Fortinet found the flaws with AI-assisted testing and warns that attackers can now move faster. Here is what to check and what to ask.
On this page
Fortinet has released an urgent set of security updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, and India's CERT-In has told organisations to treat this Fortinet update as an emergency change, not routine maintenance. If your office, shop, clinic or warehouse network uses a Fortinet firewall, this update is for you. Here is how to check your version and what to ask your IT person. It is based on CERT-In Advisory CIAD-2026-0054 and Fortinet's own blog post, both read on 26 October 2026.
What happened: Fortinet ships urgent fixes found with AI-assisted testing
- Fortinet's blog post of 21 October 2026 says fixes for FortiOS, FortiManager and FortiAnalyzer would come on 22 October 2026, after recent releases for FortiMail and FortiAuthenticator.
- Fortinet says the fixes cover vulnerabilities "identified through our frontier AI-assisted security testing program". It thanks Anthropic, OpenAI, Google and SpaceX for collaborating, and says the releases include critical and high-severity fixes.
- Fortinet asks customers to treat this as a "priority change rather than a routine maintenance cycle", and to upgrade internet-facing devices first.
- Fortinet's reason: AI tools "can now help adversaries reverse-engineer patches and build working exploits in hours or days, rather than weeks".
- CERT-In's advisory CIAD-2026-0054 of 24 October 2026 calls it a "priority emergency change, not routine maintenance".
- Fortinet will publish the detailed advisories, with CVE numbers and CVSS scores, on 10 November 2026, both notices say.
What is not known: which flaws these are, how severe each one is, and whether anyone is attacking them. Neither notice says that attacks have started.
Why it matters for a small business
A firewall is the front door of an office network. If a flaw in it, or in the console that manages it, stays open after a fix is published, the fix itself shows attackers where to look. Fortinet calls this patch diffing and says AI shortens the time needed to turn a patch into a working attack. So the first days after a patch are the risky ones, and "we will update next month" is a weaker plan than it used to be (our view).
Behind that door sit your accounts, customer lists and files. Make updates part of your team's rules, with one named person responsible. Our guides on customer data privacy and AI tools and simple AI rules for your team can help.
Who should care
- Owners whose office or shop network runs a Fortinet firewall (FortiOS is the software on Fortinet's FortiGate firewalls).
- Businesses that run FortiManager, FortiAnalyzer, FortiMail or FortiAuthenticator, usually through an IT partner.
- Owners who do not know which firewall they have: finding out is your first task.
- Everyone else: nothing to patch here, but update internet-facing devices fast, whatever the brand.
What changes for you
Before: a firewall update could wait for the next planned maintenance. Now: Fortinet and CERT-In ask for an emergency change window, internet-facing devices first. Fortinet's fixed versions, each "or above":
| Product | Fixed version, by branch |
|---|---|
| FortiOS | 8.0: 8.0.2, 7.6: 7.6.8, 7.4: 7.4.13, 7.2: 7.2.14 |
| FortiManager | 8.0: 8.0.2, 7.6: 7.6.8, 7.4: 7.4.12, 7.2: 7.2.13 |
| FortiAnalyzer | 8.0: 8.0.2, 7.6: 7.6.8, 7.4: 7.4.12, 7.2: 7.2.13 |
| FortiMail | 8.0: 8.0.2, 7.6: 7.6.7, 7.4: 7.4.9, 7.2: upgrade to the 7.4 branch or later |
| FortiAuthenticator | 8.0: 8.0.4, 6.6: 6.6.11 |
A version lower than the fixed number in its own branch is in the affected range, for example FortiOS 7.4.12 or lower.
How to check your Fortinet devices this week
- Find out who looks after your firewall (your IT person or a vendor) and which Fortinet products you have.
- Ask for the exact version of each product and compare it with the table above.
- Ask whether any management page (HTTPS or SSH) can be opened from the internet. CERT-In says to limit these to trusted IP addresses and to keep FortiManager administration off the public internet.
- Ask for a full configuration backup before the upgrade, and a date for it. Fortinet suggested 22 and 23 October 2026 for internet-facing systems; if yours is not done, do it this week (our advice).
- If the upgrade must wait, both notices say to restrict management access as in step 3 and to make multi-factor authentication compulsory for all administrator accounts. Fortinet says such steps "reduce risk but do not replace the need for a timely upgrade".
- After the upgrade, ask someone to watch the logs for unusual administrator logins or unapproved setting changes.
You can send this message to your IT person or vendor:
Hello,
CERT-In Advisory CIAD-2026-0054 (24 October 2026) asks organisations to apply Fortinet's urgent security updates. Please tell us:
- Which Fortinet products we use.
- The version each one runs today.
- Whether any management page (HTTPS or SSH) can be opened from the internet.
- The date you will upgrade to the fixed versions, and whether a full configuration backup is taken first.
- Whether all administrator accounts use multi-factor authentication.
Thank you.
This is general information, not a security audit.
What to watch next
- 10 November 2026: Fortinet's detailed advisories. Check whether your products are named.
- Updates to CIAD-2026-0054, and more fixes: Fortinet says it will keep using AI-assisted testing across its products.
- Whether other vendors give the same warning about a shorter gap between a patch and an attack.
Not sure where AI can help your business safely? The free AI Business Checkup takes about three minutes.
