Act Now! ACSC warns of critical vulnerabilities in FortiOS, FortiManager, FortiAnalyzer, and FortiMail

“Fortinet are advising customers to complete the security updates as a priority.

“The Australian Signals Directorate's Australian Cyber Security Centre (ASD’s ACSC) is monitoring the situation but has no further details beyond Fortinet’s current public advice. Fortinet is expected to release more information on 10 November 2026.”

Fortinet flagged the patches in an October 21 blog post, warning users of the patches to come a day later and telling them they “should upgrade immediately”.

“Fortinet has integrated frontier AI models into our product security testing process. These models analyze code paths, protocol handling, and configuration logic at a depth and speed that traditional fuzzing and manual review cannot match,” Fortinet said in its initial post.

“This work has helped surface vulnerabilities more efficiently than conventional methods, allowing us to proactively fix them before they may be found and exploited by malicious actors. This is our secure-by-design commitment in practice: finding and closing weaknesses at the source.

“We are also being transparent about one implication. The same class of AI capability is becoming available to attackers, particularly as open-weight models improve. The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking.”

VIEW ALL

The following products and versions are impacted:

• FortiOS 8.0, versions 8.0.0-8.0.1
• FortiOS 7.6, versions 7.6.0-7.6.7
• FortiOS 7.4, versions 7.4.0-7.4.12
• FortiOS 7.2, versions 7.2.0-7.2.13
• FortiManager 8.0, versions 8.0.0-8.0.1
• FortiManager 7.6, versions 7.6.0-7.6.7
• FortiManager 7.4, versions 7.4.0-7.4.11
• FortiManager 7.2, versions 7.2.0-7.2.12
• FortiAnalyzer 8.0, versions 8.0.0-8.0.1
• FortiAnalyzer 7.6, versions 7.6.0-7.6.7
• FortiAnalyzer 7.4, versions 7.4.0-7.4.11
• FortiAnalyzer 7.2, versions 7.2.0-7.2.12
• FortiMail 8.0, versions 8.0.0-8.0.1
• FortiMail 7.6, versions 7.6.0-7.6.6
• FortiMail 7.4, versions 7.4.0-7.4.8
• FortiMail 7.2, versions 7.2.0-7.2.9
• FortiAuthenticator 8.0, versions 8.0.0-8.0.3
• FortiAuthenticator 6.6, versions 6.6.0-6.6.10

In terms of exploitation, the ACSC said last week that it was unaware of any malicious activity targeting these platforms. However, Yordan Ganchev, principal threat intelligence specialist at cyber security firm watchTowr, told Cyber he expected “these vulnerabilities will be rapidly reverse-engineered, reproduced, and exploited in the wild”.

“Over the past week, security teams have faced a constant stream of pleasant surprises, including face-melting vulnerabilities like PHP2Shell and other vulnpocalypse entries from frequent contributors like Cisco, Oracle, and GitLab, to name a few. And if we put aside all the supply-chain poisoning attacks, anyone might think their week can only get better if they didn’t have Fortinet.” Ganchev said.

“On October 21, Fortinet released an advisory stating that customers can expect to find patches for critical and high-severity vulnerabilities in FortiMail and FortiAuthenticator on that day, and for FortiManager and FortiAnalyzer on October 22. Contrary to what one might expect, the public advisory detailing the vulnerabilities won’t be released for another three weeks.”

According to Ganchev, all the impacted products are “high-value” targets with a “long history of exploitation”.

“If we've learned anything from PHP this week, it's that preemptively announcing ‘big vulnerabilities coming soon’ only gets the industry and their LLM patch-diffing harnesses ready. Three weeks without vulnerability information gives attackers and researchers a playground to go hunting, and secrecy and obscurity don’t help anyone,” Ganchev added.

“Organisations running affected Fortinet devices should apply the patches as soon as they are available. If you have internet-exposed Fortinet management interfaces, it’s highly advisable to take them offline or restrict access to them.”