Fortinet’s urgent FortiOS fixes are out, with their details due Nov 10
- Affected
- FortiOS, FortiManager and FortiAnalyzer
7.2through8.0before the Oct 22 releases. All versions and fixes
- Vendor
- Fortinet
Fortinet released the FortiOS, FortiManager and FortiAnalyzer updates it had told customers to install urgently, and each one’s release notes date it Oct 22. Fortinet says they include critical and high-severity fixes for flaws its AI-assisted testing found, and it tells customers to upgrade internet-facing devices first. Its advisories, with the flaws’ details, are due Nov 10. Until then, the fixes themselves can show attackers where the flaws are, Fortinet says.
The releases cover FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14, and FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13. The FortiOS and FortiManager 7.6.8 release notes don’t list the security fixes, and Fortinet hasn’t given CVE IDs or scores, or said whether any of the flaws are exploited.
Fortinet said FortiSASE would be updated automatically before the release and that FortiManager Cloud releases may need a manual update. Public cloud images come through each cloud partner’s usual release process. Fortinet had already released FortiMail and FortiAuthenticator fixes from the same testing.
Fortinet says the time between disclosure and exploitation keeps shrinking. AI tools can help attackers reverse-engineer patches and build working exploits in hours or days, it says, and can chain lower-severity flaws into a more serious one. That’s why it asks customers to treat the release as a priority change rather than routine maintenance.
- Vendor
- Fortinet
What to do
6 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| FortiOS 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later |
| FortiOS 7.6 | 7.6.0 through 7.6.7 | 7.6.8 or later |
| FortiOS 7.4 | 7.4.0 through 7.4.12 | 7.4.13 or later |
| FortiOS 7.2 | 7.2.0 through 7.2.13 | 7.2.14 or later |
| FortiManager and FortiAnalyzer 8.0 | 8.0.0 through 8.0.1 | 8.0.2 or later |
| FortiManager and FortiAnalyzer 7.6 | 7.6.0 through 7.6.7 | 7.6.8 or later |
| FortiManager and FortiAnalyzer 7.4 | 7.4.0 through 7.4.11 | 7.4.12 or later |
| FortiManager and FortiAnalyzer 7.2 | 7.2.0 through 7.2.12 | 7.2.13 or later |
- Product
- FortiOS 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later
- Product
- FortiOS 7.6
- Affected
7.6.0through7.6.7- Fixed
7.6.8or later
- Product
- FortiOS 7.4
- Affected
7.4.0through7.4.12- Fixed
7.4.13or later
- Product
- FortiOS 7.2
- Affected
7.2.0through7.2.13- Fixed
7.2.14or later
- Product
- FortiManager and FortiAnalyzer 8.0
- Affected
8.0.0through8.0.1- Fixed
8.0.2or later
- Product
- FortiManager and FortiAnalyzer 7.6
- Affected
7.6.0through7.6.7- Fixed
7.6.8or later
- Product
- FortiManager and FortiAnalyzer 7.4
- Affected
7.4.0through7.4.11- Fixed
7.4.12or later
- Product
- FortiManager and FortiAnalyzer 7.2
- Affected
7.2.0through7.2.12- Fixed
7.2.13or later
Timeline
- Oct 21Fortinet tells customers to plan urgent upgrades, after releasing its FortiMail and FortiAuthenticator fixes.
- Oct 22Fortinet releases the FortiOS, FortiManager and FortiAnalyzer updates.
Sources
- Fortinet release notes for FortiOS 7.6.8Primary source docs.fortinet.com
- Fortinet release notes for FortiManager 7.6.8Primary source docs.fortinet.com
- Fortinet noticePrimary source fortinet.com