Fortinet Fixes Before Disclosure: A Sysadmin Checklist for the Window Before 10 November

Fortinet published fixed builds for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator on 22 October 2026, but CVE numbers and detailed advisories are scheduled for 10 November 2026 on the FortiGuard PSIRT page. Once details are public, patch diffing can point attackers straight at the bug. India's CERT-In (advisory CIAD-2026-0054) asks teams to treat this as a priority emergency change.

As of the reports reviewed, neither Fortinet nor CERT-In says the flaws are being exploited. That makes now the cheap time to act.

1. Build the inventory

• Every FortiGate, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator unit
• Model, current firmware branch and version
• Whether the management interface is reachable from the internet

2. Know your target version

• FortiOS: 8.0.2, 7.6.8, 7.4.13, 7.2.14 or later
• FortiManager / FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12, 7.2.13 or later
• FortiMail: 8.0.2, 7.6.7, 7.4.9 or later (7.2 users move to 7.4+)
• FortiAuthenticator: 8.0.4, 6.6.11 or later
• These are the first fixed builds per branch. Confirm against Fortinet's release notes for your model. Older branches like FortiOS 7.0 or 6.4 are not covered in the reports, so plan a move to a supported branch.

3. Upgrade safely

• Full config backup per device, stored off the box
• Follow Fortinet's upgrade path tool, do not jump branches blindly
• Edge firewalls and remote-access devices first, internal devices after

4. Interim hardening if you cannot reboot yet

• HTTPS and SSH admin only from trusted source IPs; disable admin on public interfaces
• FortiManager not exposed to the internet
• MFA on every administrator account

5. Look for signs of trouble

• Unknown admin or VPN accounts
• Config changes nobody can explain
• Unexpected reboots
• Keep the logs; in India, specified incidents must be reported to CERT-In within six hours of noticing them

More detail: Fortinet hardening release guide with the full version table

Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.