Fortinet patched in October, will disclose the flaws on 10 November

Network security vendor Fortinet released a broad security hardening update on 21-22 October 2026 covering FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. What makes this release unusual is that the company did not publish CVE identifiers or technical details alongside the fixes. According to Fortinet's own timeline, the full advisories are scheduled for 10 November 2026.

Fortinet says the flaws were found through AI-assisted code review, with current AI models used to analyse code paths, protocol handling and configuration logic. The vendor also stated that at the time of release it had seen no exploitation in the wild, and that no public CVE IDs or proof-of-concept exploits existed.

Why it matters

The three-week gap between the patch and the disclosure is where the real risk sits for organisations that have not upgraded. Attackers can compare patched and unpatched builds — a technique known as patch diffing — and reverse-engineer the fixed bug from the difference. In comments given to Cybernews, security firm watchTowr described that window as a "playground" for attackers, noting that the time between public disclosure and the first exploitation attempts has shrunk to roughly four hours.

In practice: if you upgrade before 10 November, this is routine maintenance. If you postpone it, the advisory date becomes the day everyone learns which bugs to aim at.

What this means for Turkish SMBs

Fortinet firewalls are among the most widely deployed products in small and mid-sized Turkish organisations. Construction offices, maritime agencies, logistics firms and manufacturing sites commonly run their internet-facing SSL VPN and management interfaces on these appliances. In environments like these, firmware upgrades tend to be postponed under a "don't touch what works" mindset — yet the firewall is the first layer facing the outside world, so a flaw there affects the entire internal network.

The fixed versions announced by the vendor are:

• FortiOS: 8.0.2, 7.6.8, 7.4.13, 7.2.14
• FortiManager and FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12, 7.2.13
• FortiMail: 8.0.2, 7.6.7, 7.4.9 (7.2 users need to move to 7.4 or later)
• FortiAuthenticator: 8.0.4, 6.6.11

Fortinet also noted that FortiSASE updates automatically, while FortiManager Cloud may require a manual update.

What we recommend at Kamer Bilişim

• Inventory first, then upgrade. List every Fortinet appliance with its model and firmware version, and upgrade to the versions above starting with the internet-facing ones. Taking a configuration backup beforehand turns a potential rollback into a matter of minutes rather than hours.
• Close management access to the internet. Restrict HTTPS and SSH administration to known IP addresses, keep FortiManager off the public internet, and enforce multi-factor authentication on administrator accounts. The vendor stresses that these steps reduce risk but do not replace a timely upgrade.
• Put 10 November in the calendar. When the advisories land, compare the affected version list against your own inventory and watch administrator logins and configuration-change logs more closely that week.

Whether you run Fortinet, SonicWall, Sophos or another firewall brand, turning patch tracking into a scheduled routine is what reduces news like this to ordinary maintenance. To review the firmware status of your appliances and build an upgrade plan together, reach us through our contact page.

Source: Cybernews, "Fortinet critical patches out three weeks before CVEs, sparking pre-disclosure hack fears"; SecurityOnline, "Fortinet Urges Fast Upgrades as AI-Found Flaws Hit FortiOS, FortiManager and FortiAnalyzer" (22 October 2026).