Fortinet Firewall Owners: Install the October Security Updates Now

If your business has a Fortinet FortiGate firewall, this is an update to schedule this week. On October 22, 2026, Fortinet released a coordinated set of security updates for FortiOS (the software that runs FortiGate firewalls), FortiManager and FortiAnalyzer, following updates for FortiMail and FortiAuthenticator. Fortinet says the releases include critical and high-severity fixes and urges every customer to upgrade promptly, starting with devices that face the internet.

Fortinet is not publishing the details of the flaws until its next scheduled advisory day, November 10, 2026. Its Chief Information Security Officer, Carl Windsor, explains why waiting is risky: once updates are out, attackers can compare old and new versions to find what was fixed, and AI tools can help them build working attacks in hours or days rather than weeks.

The short version: back up your firewall configuration, upgrade to a fixed version, and make sure the firewall's admin page isn't open to the internet.

What's different about this release

Fortinet says many of these fixes came from its own testing with frontier AI models, which it ran with help from Anthropic, OpenAI, Google and SpaceX. That means the problems were found and fixed before Fortinet saw them used in attacks. Fortinet also notes that the same kind of AI is available to attackers, which is why it is asking customers to treat this as a priority change rather than routine maintenance.

Which versions to install

• FortiOS (FortiGate firewalls): 8.0.2, 7.6.8, 7.4.13 or 7.2.14 or later, depending on the branch you run.
• FortiManager and FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12 or 7.2.13 or later.
• FortiMail: 8.0.2, 7.6.7 or 7.4.9 or later. FortiMail 7.2 customers should move to the 7.4 branch or later.
• FortiAuthenticator: 8.0.4 or 6.6.11 or later.

Fortinet says FortiSASE was updated automatically. FortiManager Cloud may need a manual update, and firewalls running in public clouds get updates through the cloud provider's normal process.

Stolen firewall passwords are a separate problem

Updating closes software flaws, but it doesn't fix stolen passwords. In an October 6 advisory, the FBI and U.S. Secret Service warned about FortiBleed, an ongoing campaign that uses leaked or reused passwords to get into internet-facing FortiGate firewalls and SSL VPNs. They say attackers create new admin accounts, sometimes delete or change the real ones so the owner is locked out, and sell the access to ransomware groups. Their key steps are to restrict who can reach the admin page, end all active admin and VPN sessions and reset those passwords, and require phishing-resistant multifactor sign-in.

What to do this week

1. Make a list. Note every Fortinet device you have and which software version each one runs, starting with anything reachable from the internet.
2. Back up the configuration first. Fortinet recommends saving the current configuration before upgrading.
3. Upgrade during a planned window. A firewall upgrade usually means a short internet outage, so pick a time that works for your staff.
4. If you can't upgrade right away, reduce exposure. Fortinet suggests limiting the admin page (HTTPS and SSH) to trusted IP addresses or turning it off on outside connections, keeping FortiManager off the internet, using strong unique passwords and requiring MFA for every admin account. Fortinet says these steps lower the risk but don't replace the upgrade.
5. Check the accounts. Look for admin or VPN accounts you don't recognize and watch the logs for unusual admin logins or configuration changes.

Questions to ask your IT provider

1. Which Fortinet products do we have, and are they all on a fixed version from Fortinet's October 22 release?
2. Is our firewall's admin page reachable from the internet?
3. Do all admin and VPN accounts require multifactor sign-in?
4. Has anyone checked for admin accounts we didn't create?