Fortinet coordinated security hardening release: critical and high-severity fixes in FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, with the advisories withheld until 2026-11-10

Fortinet announced on 2026-10-21 a coordinated set of security updates for FortiOS, FortiManager and FortiAnalyzer, scheduled for 2026-10-22 and following recent releases for FortiMail and FortiAuthenticator (Fortinet, 2026-10-21). Fortinet says the releases fix vulnerabilities found through its frontier-AI-assisted testing programme, that they include critical and high-severity fixes, and that customers should treat them as a priority change rather than routine maintenance, because AI tools can help adversaries reverse-engineer patches and build working exploits in hours or days, patch differences show where the weakness sits, and AI can chain lower-severity flaws (Fortinet, 2026-10-21). The public advisories will appear only at the next Patch Tuesday, 2026-11-10 (Fortinet, 2026-10-21). NCSC.ch's advisory describes the fixes as ones that might allow attackers to gain unauthorized control over affected security infrastructure and lists the current exploitation status as unknown (NCSC.ch, 2026-10-22).

Fortinet's tables name these affected and fixed versions: FortiOS 8.0.0 to 8.0.1 (fixed 8.0.2), 7.6.0 to 7.6.7 (7.6.8), 7.4.0 to 7.4.12 (7.4.13) and 7.2.0 to 7.2.13 (7.2.14); FortiManager and FortiAnalyzer 8.0.0 to 8.0.1 (8.0.2), 7.6.0 to 7.6.7 (7.6.8), 7.4.0 to 7.4.11 (7.4.12) and 7.2.0 to 7.2.12 (7.2.13); FortiMail 8.0.0 to 8.0.1 (8.0.2), 7.6.0 to 7.6.6 (7.6.7), 7.4.0 to 7.4.8 (7.4.9) and 7.2.0 to 7.2.9 (upgrade to the 7.4 branch or later); FortiAuthenticator 8.0.0 to 8.0.3 (8.0.4) and 6.6.0 to 6.6.10 (6.6.11) (Fortinet, 2026-10-21). FortiSASE updates automatically, FortiManager Cloud may need a manual update, and public-cloud instances follow their cloud partners' release processes (Fortinet, 2026-10-21). heise online lists the same fixed builds and the same 2026-11-10 disclosure date (heise online, 2026-10-22).

The FortiMail rows are identical to the fix table of Fortinet's advisory FG-IR-26-175, an unauthenticated path traversal in the FortiMail IBE webmail service (CVE-2026-104286) that Fortinet reports as exploited in the wild (Fortinet PSIRT, 2026-10-01). Those FortiMail builds therefore already fix a flaw under attack, and the post does not say whether they carry further fixes; for FortiOS, FortiManager, FortiAnalyzer and FortiAuthenticator no source states exploitation.