Fortinet fixes FortiOS flaws it won’t detail until Nov 10
- Affected
- FortiOS, FortiManager and FortiAnalyzer
7.2through8.0, FortiMail7.2through8.0and FortiAuthenticator6.6and8.0before the fixed releases. All versions and fixes
- Vendor
- Fortinet
Fortinet says it will release fixes for FortiOS, FortiManager and FortiAnalyzer on Oct 22, after releasing fixes for FortiMail and FortiAuthenticator on Oct 21. It says the releases include critical and high-severity fixes, and tells customers to upgrade as soon as each is available, starting with internet-facing devices. Its advisories, with the details of the flaws, come out on Nov 10. Fortinet presents the flaws as found by its own testing and hasn’t said whether any are exploited.
Fortinet says the flaws came from its frontier AI-assisted security testing, and it asks customers to treat the release as a priority change rather than routine maintenance. AI tools can help attackers reverse-engineer patches and build working exploits in hours or days, it says. Once the updates are public, it says, the fixes themselves show where the flaws were.
The FortiOS, FortiManager and FortiAnalyzer releases cover the 8.0, 7.6, 7.4 and 7.2 branches. FortiMail 7.2 gets no fix, and Fortinet says to move it to the 7.4 branch or later. FortiSASE is updated automatically before the Oct 22 release, FortiManager Cloud releases may need a manual update, and public cloud images come through each cloud partner’s usual release process.
Fortinet hasn’t named the flaws or given their CVE IDs or scores. It says the advisories will appear on its product security advisories page at its next Patch Tuesday, Nov 10.
- Vendor
- Fortinet
What to do
8 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| FortiOS 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later, due Oct 22 |
| FortiOS 7.6 | 7.6.0 through 7.6.7 | 7.6.8 or later, due Oct 22 |
| FortiOS 7.4 | 7.4.0 through 7.4.12 | 7.4.13 or later, due Oct 22 |
| FortiOS 7.2 | 7.2.0 through 7.2.13 | 7.2.14 or later, due Oct 22 |
| FortiManager and FortiAnalyzer 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later, due Oct 22 |
| FortiManager and FortiAnalyzer 7.6 | 7.6.0 through 7.6.7 | 7.6.8 or later, due Oct 22 |
| FortiManager and FortiAnalyzer 7.4 | 7.4.0 through 7.4.11 | 7.4.12 or later, due Oct 22 |
| FortiManager and FortiAnalyzer 7.2 | 7.2.0 through 7.2.12 | 7.2.13 or later, due Oct 22 |
| FortiManager Cloud | Earlier releases | Available by Oct 22, possibly as a manual update |
| FortiSASE | Updated by Fortinet | No action needed |
| FortiMail 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later |
| FortiMail 7.6 | 7.6.0 through 7.6.6 | 7.6.7 or later |
| FortiMail 7.4 | 7.4.0 through 7.4.8 | 7.4.9 or later |
| FortiMail 7.2 | 7.2.0 through 7.2.9 | Upgrade to the 7.4 branch or later |
| FortiAuthenticator 8.0 | 8.0.0 through 8.0.3 | 8.0.4 or later |
| FortiAuthenticator 6.6 | 6.6.0 through 6.6.10 | 6.6.11 or later |
- Product
- FortiOS 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later, due Oct 22
- Product
- FortiOS 7.6
- Affected
7.6.0through7.6.7- Fixed
7.6.8or later, due Oct 22
- Product
- FortiOS 7.4
- Affected
7.4.0through7.4.12- Fixed
7.4.13or later, due Oct 22
- Product
- FortiOS 7.2
- Affected
7.2.0through7.2.13- Fixed
7.2.14or later, due Oct 22
- Product
- FortiManager and FortiAnalyzer 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later, due Oct 22
- Product
- FortiManager and FortiAnalyzer 7.6
- Affected
7.6.0through7.6.7- Fixed
7.6.8or later, due Oct 22
- Product
- FortiManager and FortiAnalyzer 7.4
- Affected
7.4.0through7.4.11- Fixed
7.4.12or later, due Oct 22
- Product
- FortiManager and FortiAnalyzer 7.2
- Affected
7.2.0through7.2.12- Fixed
7.2.13or later, due Oct 22
- Product
- FortiManager Cloud
- Affected
- Earlier releases
- Fixed
- Available by Oct 22, possibly as a manual update
- Product
- FortiSASE
- Affected
- Updated by Fortinet
- Fixed
- No action needed
- Product
- FortiMail 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later
- Product
- FortiMail 7.6
- Affected
7.6.0through7.6.6- Fixed
7.6.7or later
- Product
- FortiMail 7.4
- Affected
7.4.0through7.4.8- Fixed
7.4.9or later
- Product
- FortiMail 7.2
- Affected
7.2.0through7.2.9- Fixed
- Upgrade to the
7.4branch or later
- Product
- FortiAuthenticator 8.0
- Affected
8.0.0through8.0.3- Fixed
8.0.4or later
- Product
- FortiAuthenticator 6.6
- Affected
6.6.0through6.6.10- Fixed
6.6.11or later
Sources
- Fortinet noticePrimary source fortinet.com