Fortinet Ships Urgent FortiOS Patches Before Naming the Flaws

Fortinet told customers on Thursday to install emergency updates for critical and high-severity flaws in FortiOS, FortiManager and FortiAnalyzer. It will not say what the flaws are until November 10, nearly three weeks after the patches shipped. Internet-facing devices come first, and the wait for details is drawing the sharpest criticism.

The updates were scheduled for October 22, 2026, and heise describes them as urgent out-of-band updates that offer few details. Fortinet's Chief Information Security Officer, Carl Windsor, published the announcement in an October 21 blog post, according to Cybernews. The release also includes new versions of FortiAuthenticator and FortiMail.

Fortinet says the fixes were "identified through our frontier AI-assisted security testing program." That program runs with partners including Anthropic's Glasswing (Mythos) and OpenAI's Daybreak (GPT 5.5 Cyber) projects. The AI angle is why this release is drawing attention beyond the usual patch crowd, and it is also why the missing details matter. Fortinet has not said how many flaws it fixed, and IT-Connect notes the same gap.

No confirmed in-the-wild exploitation has been reported so far. This is a patch-now story with a clock running, not a breach report.

Fortinet emergency patch: the builds that fix the flaws

The version numbers below come mainly from secondary coverage, including Security Online, rather than from a Fortinet advisory. Confirm them in Fortinet's own portal before you schedule changes.

The FortiMail row needs a second look. The sources do not agree on whether those builds shipped on October 21 or 22. Don't assume a FortiMail appliance is current because it appears on a release list. Check the build number on the device itself.

Why Fortinet is shipping fixes before naming the flaws

Fortinet's reasoning, as Cybernews reported, is that it did not want customers to treat the critical fixes as just another "Fortinet routine maintenance cycle." The company's logic is that patching first lets customers upgrade before technical details circulate. A standard advisory pairs fixes with CVE identifiers so scanners, ticketing systems and threat feeds can react the same day. Fortinet is separating those two steps on purpose.

Critics argue that the same gap gives attackers a head start, since anyone who compares old and new code can learn what changed. Fortinet has used this sequence before. CyberScoop reported that CVE-2025-64446 was patched on October 28 and not publicly disclosed until 17 days later. The outlet framed that delay as a disadvantage for defenders, and the new release follows the same playbook.

The cost falls on defenders. Until November 10, there is no CVE to match against vulnerability scanners or threat-intelligence feeds. Teams that rely on those tools will have to fall back on version checks and vendor notices, which is slower work across a large fleet.

How AI-found flaws and shorter exploit windows raise the stakes

Fortinet's own advice, as reported, warns that attackers could use patch diffing and AI-assisted analysis to build exploits before upgrades finish. Expert In the Cloud and iConnect IT both carry that warning. Patch diffing compares a vulnerable build with a fixed one to find the code that changed. That work once demanded specialist reverse engineers. AI tools could make it faster and open to far more people.

Yordan Ganchev, principal threat intelligence specialist at watchTowr, expects quick follow-through. "We expect these vulnerabilities will be rapidly reverse-engineered, reproduced, and exploited in the wild," he said, as quoted by Cybernews. The same report said watchTowr had stated in September that the window between patch and exploit had fallen from two weeks to four hours. If that estimate is anywhere close, a three-week wait for CVE details gives attackers far more room than defenders get.

Fortinet is not new to this kind of story. In 2026, CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog after PEERSTITCH malware used the flaw to compromise more than 500 firewalls, according to SC World. That history explains why many administrators treat Fortinet edge devices as top priority, even before a CVE appears.

The pressure is not unique to Fortinet. USA 24's coverage of Google Chrome 156 shows the same strain from another vendor, with 353 security fixes and six rated critical in a single release.

What to do before November 10

US businesses, universities, hospitals and federal agencies that run FortiGate or FortiManager are the most exposed, especially where devices face the internet. Start with an inventory. Find every FortiOS, FortiManager, FortiAnalyzer and FortiAuthenticator device, including cloud-managed ones, and compare each version against the table above. Then work in this order:

• Upgrade internet-facing devices first, then management interfaces, as Fortinet advised.
• Until upgrades are finished, restrict administrative access to trusted IP addresses.
• Keep FortiManager off the public internet.
• Enforce multi-factor authentication for every administrator account.
• Apply virtual patches where your security vendor offers them.
• Look for administrator accounts you do not recognize and for configuration changes nobody made. CyberScoop noted that these were the signs in earlier Fortinet exploitation cases.

Federal agencies should also plan for CISA's Known Exploited Vulnerabilities deadlines, which may apply once a Fortinet CVE from this release is listed. Do not wait for November 10 to start the upgrade work. A quiet inventory now will save hours of scrambling later.

What remains unknown

• No CVE IDs have been published. Some sources say numbers will appear on November 10, while others describe the flaws only as critical and high severity.
• Fortinet has not stated how many flaws the release covers.
• Exploitation status needs a recheck before anyone relies on it. One summary reports no in-the-wild exploitation and no public proof-of-concept.
• It is unknown whether CISA will add any of these flaws to its catalog before November 10.
• It is an open question whether other vendors using AI-found bugs will follow Fortinet's approach.

What to watch on November 10

November 10 is the date that matters. When Fortinet publishes the CVE IDs and full advisories, the first job is matching each identifier to the builds in the table above. Scanner vendors will likely add detections once there are CVEs to key on, and CISA's next catalog update will show whether any of these flaws are being used in attacks. Until then, the safest assumption is that the clock is already running. If other vendors adopt the same patch-first, details-later model, defenders will have to schedule upgrades around vendor timing rather than public detail, and that is a harder habit to build.