Fortinet patches AI-found FortiOS flaws, CVEs come Nov 10
Fortinet's security hardening release fixes AI-found flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Patch now; details land November 10.
Fortinet just asked its customers to patch before it tells them what is broken. The company's security hardening release fixes critical and high-severity flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, found with help from frontier AI models. The CVEs and full advisories do not publish until November 10. If your office firewall says FortiGate on the front, that three-week gap is your patch window.
What actually happened
In an October 21 post, Fortinet CISO Carl Windsor said the company has built frontier AI models into its product security testing, and that the resulting fixes ship as one coordinated release. Fortinet thanked Anthropic, OpenAI, Google, and SpaceX for their help.
FortiOS, FortiManager, and FortiAnalyzer updates went out October 22. FortiMail and FortiAuthenticator shipped with the post. The FortiOS fixed builds are:
- 8.0.2 (affected 8.0.0–8.0.1)
- 7.6.8 (affected 7.6.0–7.6.7)
- 7.4.13 (affected 7.4.0–7.4.12)
- 7.2.14 (affected 7.2.0–7.2.13)
FortiMail 7.2 gets no fix; Fortinet says to move to 7.4 or later. Fortinet calls this "a priority change rather than a routine maintenance cycle." Its order of work: inventory every FortiOS and FortiManager device, patch internet-facing ones first, back up configs, then watch logs for odd admin logins. If you can't upgrade yet, it says to restrict HTTPS and SSH admin access to trusted IPs, keep FortiManager off the internet, and enforce MFA on admin accounts. The post does not say any of the flaws are being exploited.
Why the Fortinet patch matters for your business
Delayed details do not mean delayed attacks. Attackers can compare the old and new firmware and find the bug themselves. With AI doing the diffing, three weeks is a long time. Patch on Fortinet's schedule, not the CVE schedule.
Your firewall is the front door. In a small business, the FortiGate often sits between the internet and everything: the POS, the file share, the VPN your staff use from home. One device, total blast radius.
Ask who owns the box. Many small shops got their firewall from an MSP years ago. Ask them, in writing, which firmware it runs and when it moves to the fixed build.
Key takeaways
- Fortinet fixed AI-found critical and high flaws across five products on October 21–22
- FortiOS fixed builds: 8.0.2, 7.6.8, 7.4.13 and 7.2.14
- CVE IDs and advisories publish November 10, so patch before the details go public
- Patch internet-facing devices first and lock admin interfaces to trusted IPs
- If an MSP runs your firewall, get the firmware version and upgrade date in writing
Don't know what firmware your firewall runs? We map your network edge, check every device against the fixed builds, and set up a patch routine that doesn't depend on someone remembering. Ask us to check your edge devices, or see how we run IT for small teams.
Sources: Fortinet: Security Hardening Release for Multiple Products.
- #security
- #fortinet
- #firewall
- #patching
- #ai-security
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Plex2Shell: update Plex Media Server, then check for miners
Plex2Shell chains four Plex Media Server flaws into remote code execution. CISA lists it as exploited. Update to 1.43.3.10861 and check the box for implants.
Read itNode.js Brotli bug CVE-2026-111497: upgrade Node this week
The October 21 Node.js security release fixes a Brotli decoder memory bug that can allow RCE, plus three high TLS and DNS flaws. Upgrade to 22.23.4, 24.22.1 or 26.12.1.
Read it