Fortinet schedules FortiOS fixes for Oct 22 and holds the details until Nov 10
- Affected
- FortiOS, FortiManager, FortiAnalyzer and FortiMail
7.2through8.0, and FortiAuthenticator6.6and8.0, before the fixed versions. All versions and fixes
- Vendor
- Fortinet
Fortinet says it will release fixes for FortiOS, FortiManager and FortiAnalyzer on Oct 22 and hold their advisories until Nov 10. Fixes for FortiMail and FortiAuthenticator came out Oct 21, and Fortinet rates the flaws critical and high severity. It hasn’t said what they let attackers do or whether attackers have used any of them, and it hasn’t published CVE IDs. Fortinet tells customers to upgrade as soon as the fixes are out, internet-facing devices first.
Fortinet says the releases include fixes for flaws found by its frontier AI-assisted security testing program, and it thanks Anthropic, OpenAI, Google and SpaceX for their collaboration. It recommends that customers treat the release as “a priority change rather than a routine maintenance cycle”. Its reasons include that AI tools can now help attackers turn patches into working exploits in hours or days rather than weeks. Once the updates are public, it adds, the changes in them can show attackers where the flaws are, and AI can chain lower-severity flaws into a more severe one.
Fortinet says FortiSASE is updated automatically before the Oct 22 release, and FortiManager Cloud may need a manual update. Public cloud instances get their updates from the cloud providers, through their usual release process.
Until devices can be upgraded, Fortinet advises managing them out of band, moving resources behind a VPN or secure access service edge (SASE) where possible and applying virtual patches. It says limiting admin access and its other interim steps reduce risk but don’t replace a timely upgrade.
Fortinet hasn’t said how many flaws the releases fix. Its notice doesn’t list FortiOS 7.0 or older, and Fortinet hasn’t said whether those branches are affected.
In a Jun 30 post, Fortinet said it was testing the source code of 30 product families with frontier AI models from several companies. It said that at that point, 40% of the findings were real flaws, and that it would fix them over the following weeks and months.
- Vendor
- Fortinet
What to do
8 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| FortiOS 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later |
| FortiOS 7.6 | 7.6.0 through 7.6.7 | 7.6.8 or later |
| FortiOS 7.4 | 7.4.0 through 7.4.12 | 7.4.13 or later |
| FortiOS 7.2 | 7.2.0 through 7.2.13 | 7.2.14 or later |
| FortiManager 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later |
| FortiManager 7.6 | 7.6.0 through 7.6.7 | 7.6.8 or later |
| FortiManager 7.4 | 7.4.0 through 7.4.11 | 7.4.12 or later |
| FortiManager 7.2 | 7.2.0 through 7.2.12 | 7.2.13 or later |
| FortiAnalyzer 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later |
| FortiAnalyzer 7.6 | 7.6.0 through 7.6.7 | 7.6.8 or later |
| FortiAnalyzer 7.4 | 7.4.0 through 7.4.11 | 7.4.12 or later |
| FortiAnalyzer 7.2 | 7.2.0 through 7.2.12 | 7.2.13 or later |
| FortiMail 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later |
| FortiMail 7.6 | 7.6.0 through 7.6.6 | 7.6.7 or later |
| FortiMail 7.4 | 7.4.0 through 7.4.8 | 7.4.9 or later |
| FortiMail 7.2 | 7.2.0 through 7.2.9 | Upgrade to the 7.4 branch or later |
| FortiAuthenticator 8.0 | 8.0.0 through 8.0.3 | 8.0.4 or later |
| FortiAuthenticator 6.6 | 6.6.0 through 6.6.10 | 6.6.11 or later |
- Product
- FortiOS 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later
- Product
- FortiOS 7.6
- Affected
7.6.0through7.6.7- Fixed
7.6.8or later
- Product
- FortiOS 7.4
- Affected
7.4.0through7.4.12- Fixed
7.4.13or later
- Product
- FortiOS 7.2
- Affected
7.2.0through7.2.13- Fixed
7.2.14or later
- Product
- FortiManager 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later
- Product
- FortiManager 7.6
- Affected
7.6.0through7.6.7- Fixed
7.6.8or later
- Product
- FortiManager 7.4
- Affected
7.4.0through7.4.11- Fixed
7.4.12or later
- Product
- FortiManager 7.2
- Affected
7.2.0through7.2.12- Fixed
7.2.13or later
- Product
- FortiAnalyzer 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later
- Product
- FortiAnalyzer 7.6
- Affected
7.6.0through7.6.7- Fixed
7.6.8or later
- Product
- FortiAnalyzer 7.4
- Affected
7.4.0through7.4.11- Fixed
7.4.12or later
- Product
- FortiAnalyzer 7.2
- Affected
7.2.0through7.2.12- Fixed
7.2.13or later
- Product
- FortiMail 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later
- Product
- FortiMail 7.6
- Affected
7.6.0through7.6.6- Fixed
7.6.7or later
- Product
- FortiMail 7.4
- Affected
7.4.0through7.4.8- Fixed
7.4.9or later
- Product
- FortiMail 7.2
- Affected
7.2.0through7.2.9- Fixed
- Upgrade to the
7.4branch or later
- Product
- FortiAuthenticator 8.0
- Affected
8.0.0through8.0.3- Fixed
8.0.4or later
- Product
- FortiAuthenticator 6.6
- Affected
6.6.0through6.6.10- Fixed
6.6.11or later
Timeline
- Jun 30Fortinet says it is testing its products’ source code with frontier AI models and will fix what they find.
- Oct 21Fortinet releases FortiMail and FortiAuthenticator fixes and announces fixes for FortiOS, FortiManager and FortiAnalyzer.
- Oct 22Fortinet is due to release the FortiOS, FortiManager and FortiAnalyzer fixes.
- Nov 10Fortinet is due to publish the advisories.
Sources
- Fortinet hardening release noticePrimary source fortinet.com
- Fortinet frontier AI updatePrimary source fortinet.com