In this article
If your company runs a FortiGate firewall, update its FortiOS software now to 8.0.2, 7.6.8, 7.4.13 or 7.2.14, depending on the line it runs. On 21 October 2026 Fortinet announced that these releases, available since 22 October, fix critical and high-severity flaws it found with the help of frontier AI models, and that it will publish the details on 10 November. After that date every attacker knows where to look, and unpatched devices become easy targets. The update usually takes a short maintenance window; putting it off is the real risk.
What exactly did Fortinet announce?
Carl Windsor, Fortinet's Chief Information Security Officer, published an official notice titled «Fortinet Releases Security Hardening Release for Multiple Products». It says the fixes came from a security testing programme that uses frontier AI, run with Anthropic, OpenAI, Google and SpaceX, so 4 outside organisations. Fortinet has not yet published CVE numbers or scores; those will appear in its PSIRT advisories on 10 November. Earlier this month we covered an exploited FortiMail flaw; this release is wider, because it covers the firewall itself.
Why not wait until 10 November?
Fortinet gives the reason itself: AI tools now help attackers compare the old release with the new one, work out the flaw from the difference, and build a working exploit in hours or days rather than weeks. Publishing a fix gives part of the secret away, so the 19 days between 22 October and 10 November are not a safe grace period; they are a race. Fortinet adds that AI can also chain lower-severity flaws together until they become exploitable.
The most exposed businesses are those whose staff work remotely over a VPN on a FortiGate, those that link branches and warehouses to head office through it, and those that manage their devices over the internet from outside the office. In these cases the device is visible to anyone on the internet, and it is the first thing an attacker will try once the details are out. If an outside provider manages your device, do not assume it has been updated: ask for written confirmation of the new version number and the upgrade date.
Which versions do you need?
- FortiOS (the FortiGate operating system): 8.0.2 for the 8.0 line, 7.6.8 for 7.6, 7.4.13 for 7.4 and 7.2.14 for 7.2, or anything newer.
- FortiManager and FortiAnalyzer (central management and logs): 8.0.2, 7.6.8, 7.4.12 and 7.2.13 or newer.
- FortiMail (email gateway): 8.0.2, 7.6.7 and 7.4.9; the 7.2 line must move to 7.4 or later.
- FortiAuthenticator (identity): 8.0.4 and 6.6.11 or newer.
If your device runs a line that is not on this list, ask your provider whether that line still receives security updates at all. If it does not, the device needs a bigger upgrade.
Five steps to ask your IT team for this week
- Inventory: a list of every FortiGate and FortiManager in the head office and branches, with the version each one runs.
- Internet-facing devices first: the firewall that takes staff VPN connections or links your branches gets updated first, as Fortinet recommends.
- Back up the configuration before upgrading: so you can roll back if something breaks.
- Follow the right upgrade path: jumping between distant versions can need intermediate steps, and Fortinet's official upgrade path tool lists them.
- Review the logs: look for any unfamiliar administrative login on the device; the announcement recommends this explicitly.
If you cannot update right away
As a stopgap, Fortinet recommends restricting the management interfaces (HTTPS and SSH) to trusted IP addresses, turning off administration on the internet-facing interface, using strong, unique passwords for every administrator account, and enforcing multi-factor authentication for all administrators. These measures reduce the risk without removing it; they are a bridge to the upgrade, not a substitute for it.
It is better to set the upgrade date now than to wait for a convenient moment that never comes: pick a weekday evening or a weekend, warn staff and branches in advance about a possible short outage, and ask the team for a brief report afterwards listing every device and its new version number. That way you have a clear record to come back to when the next critical update is released.
The Origami view
The firewall is your company's door to the internet, and most businesses buy it and then forget it for years. What is changing is that attackers now have the same AI tools that find the flaws, so the gap between a fix being published and the flaw being exploited keeps shrinking. That is why we think every company needs a written policy: who updates the device, within how many days of a critical fix, and who checks that it was done. If you want your network setup or internet-facing systems reviewed, get in touch.
Sources
Frequently asked questions
How do I know whether my company's firewall needs this update?
Ask your IT team for the FortiOS version on every FortiGate. If it is older than 8.0.2, 7.6.8, 7.4.13 or 7.2.14 on its line, it needs the update Fortinet released on 22 October 2026.
Will our internet go down during the update?
Restarting the device after the upgrade usually cuts the connection briefly, which is why Fortinet recommends scheduling a maintenance window and backing up the configuration first.
What happens on 10 November?
Fortinet publishes its security advisories explaining the flaws in detail. After that, any attacker can more easily target unpatched devices, so it is best to finish the upgrade before that date.
I cannot update right now. What is the stopgap?
Restrict management access to trusted IP addresses, turn off administration on the internet-facing interface and enforce multi-factor authentication for administrators. This lowers the risk until the upgrade but does not remove it.
Follow Origami in Google
Pin Origami as a preferred source and our articles will surface first for you in Google Search and Top Stories.
