Fortinet released a coordinated set of security updates for FortiOS, FortiManager and FortiAnalyzer on 22 October 2026, following earlier fixes for FortiMail and FortiAuthenticator. The vendor is asking customers to treat the release as a priority change rather than a maintenance cycle, even though the CVE detail will not be published until 10 November.
What happened
Every supported FortiOS branch gets a new build, along with the management and analytics products that sit behind it. Fortinet says the releases contain critical and high-severity fixes found partly through its frontier AI-assisted security testing programme, and credits Anthropic, OpenAI, Google and SpaceX for collaboration on that effort.
The PSIRT advisories that normally accompany a patch release are withheld until Fortinet's next Patch Tuesday on 10 November. For the next three weeks there are no CVE identifiers, no per-bug severity scores and no public description of the affected components. Fortinet frames the delay as balancing transparency against giving customers time to upgrade.
Who is affected
Practically every Fortinet estate on a supported branch needs a change window. The affected builds are:
- FortiOS 8.0.0 to 8.0.1, 7.6.0 to 7.6.7, 7.4.0 to 7.4.12 and 7.2.0 to 7.2.13
- FortiManager on the same four branches, up to 8.0.1, 7.6.7, 7.4.11 and 7.2.12
- FortiAnalyzer on the same four branches, up to the same build numbers
- FortiMail 8.0.0 to 8.0.1, 7.6.0 to 7.6.6, 7.4.0 to 7.4.8 and 7.2.0 to 7.2.9
- FortiAuthenticator 8.0.0 to 8.0.3 and 6.6.0 to 6.6.10
- Any appliance whose HTTPS or SSH administration interface answers from the internet, which raises the urgency sharply
What to do now
Upgrade internet-facing FortiGates and every FortiManager to the fixed builds in change windows on 22 and 23 October, starting with anything whose admin interface is reachable from the internet.
- Back up the configuration first, and upgrade FortiManager ahead of the firewalls if your devices are managed through it
- FortiOS fixed builds are 8.0.2, 7.6.8, 7.4.13 and 7.2.14
- FortiManager fixed builds are 8.0.2, 7.6.8, 7.4.12 and 7.2.13; FortiAnalyzer uses the same numbers
- FortiMail fixed builds are 8.0.2, 7.6.7 and 7.4.9; FortiAuthenticator needs 8.0.4 or 6.6.11
- If you cannot patch today, restrict HTTPS and SSH administration to trusted addresses and confirm FortiManager is not reachable from the internet at all
- Review logs for unexpected administrator logins or unapproved configuration changes, before and after the upgrade
What this means for South African businesses
FortiGate is the default perimeter device for a large slice of South African SMEs, and many of those estates are run remotely through FortiManager or a hosted console, so one missed upgrade can expose an entire customer base. Patching without a severity score is uncomfortable for anyone used to waiting for a CVSS number before booking downtime. My judgement: the missing advisory detail is a reason to move faster, not slower, because the fixed builds themselves show an attacker where the code changed and the patch-to-exploit gap is now measured in days.
Source: Fortinet CISO advisory on the October 2026 hardening release, published 22 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.