(TLP:CLEAR) Vulnerability Notification – Fortinet Critical Security Updates

ACTION MAY BE REQUIRED for utilities using Fortinet FortiOS (FortiGate firewalls and VPN gateways), FortiManager, FortiAnalyzer, FortiMail, or FortiAuthenticator. Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.

Summary: Fortinet has released a coordinated set of security updates addressing critical and high-severity vulnerabilities in FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator, all identified through the company’s AI-assisted security testing program. CVE identifiers, CVSS scores, and technical details have not yet been released; those will come with public advisories on the Fortinet PSIRT page on November 10, 2026.

No active exploitation has been reported so far. However, WaterISAC is sharing this notification now because attackers can analyze the publicly available fixes to develop exploits before November 10, and the risk to unpatched devices will only grow once full details are released.

Even without confirmed exploitation, Fortinet urges customers to treat these upgrades as a priority change rather than routine maintenance. Fortinet warns that AI tools can now help adversaries reverse-engineer patches and develop working exploits within hours or days. Now that the fixed versions are public, the changes themselves can point attackers to the underlying weaknesses. The period before the November 10 public disclosure gives members a window to upgrade before full vulnerability details become available to all threat actors.

Because CVE identifiers have not yet been published, vulnerability scanners and asset management tools that rely on CVE data may not flag affected devices until after November 10. WaterISAC encourages members to verify firmware versions directly against the affected versions listed below.

FortiSASE has been updated automatically. FortiManager Cloud updates are available but may require a manual update. Public cloud instances are being updated through the relevant cloud partners’ standard release processes.

Members using FortiMail are also advised that the fixed FortiMail versions address CVE-2026-104286, which Fortinet reports has been exploited in the wild.

Affected Versions

• FortiOS: 8.0.0–8.0.1 (fixed in 8.0.2), 7.6.0–7.6.7 (fixed in 7.6.8), 7.4.0–7.4.12 (fixed in 7.4.13), 7.2.0–7.2.13 (fixed in 7.2.14)
• FortiManager: 8.0.0–8.0.1 (fixed in 8.0.2), 7.6.0–7.6.7 (fixed in 7.6.8), 7.4.0–7.4.11 (fixed in 7.4.12), 7.2.0–7.2.12 (fixed in 7.2.13)
• FortiAnalyzer: 8.0.0–8.0.1 (fixed in 8.0.2), 7.6.0–7.6.7 (fixed in 7.6.8), 7.4.0–7.4.11 (fixed in 7.4.12), 7.2.0–7.2.12 (fixed in 7.2.13)
• FortiMail: 8.0.0–8.0.1 (fixed in 8.0.2), 7.6.0–7.6.6 (fixed in 7.6.7), 7.4.0–7.4.8 (fixed in 7.4.9), 7.2.0–7.2.9 (upgrade to the 7.4 branch or later)
• FortiAuthenticator: 8.0.0–8.0.3 (fixed in 8.0.4), 6.6.0–6.6.10 (fixed in 6.6.11)

Interim Mitigations

Where upgrades cannot be completed immediately, Fortinet recommends the following steps. Fortinet notes that these steps reduce risk but do not replace the need for a timely upgrade.

• Restricting administrative interfaces (HTTPS, SSH) to trusted IP addresses or disabling them on external interfaces
• Ensuring FortiManager administration is not reachable from the internet
• Using strong, unique credentials and enforcing MFA for all administrator accounts
• Managing devices out of band, moving resources behind VPN or SASE where feasible, and applying virtual patches

Additional Reading

• Fortinet Releases Security Hardening Release for Multiple Products
• ASD’s ACSC: Critical Vulnerabilities in Fortinet Products
• CCB: Fortinet Releases Critical Security Hardening Updates for Multiple Products, Patch Immediately