Fortinet told customers to install unscheduled fixes for critical and high-severity flaws in its FortiOS firewall software and four other products, with the FortiOS updates due Thursday, while withholding any description of the bugs until Nov. 10, the company said in a security notice. Fortinet said the flaws were found by frontier artificial intelligence models, and it is asking organizations to patch some of their most exposed equipment before attackers can work out what changed.
Everything known so far comes from a single source: a notice by Fortinet Chief Information Security Officer Carl Windsor, posted Wednesday on the company's blog. No vulnerability identifiers (CVE numbers), severity scores or technical details have been published, and Fortinet has not reported any exploitation in the wild. The German tech outlet heise covered the notice Thursday.
What Happened
In the post, titled "Fortinet Releases Security Hardening Release for Multiple Products," Fortinet said fixes for FortiMail and FortiAuthenticator were available that day and that releases for FortiOS, FortiManager and FortiAnalyzer were scheduled for Oct. 22.
The fixed builds are FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14; FortiManager and FortiAnalyzer 8.0.2, 7.6.8, 7.4.12 and 7.2.13; FortiMail 8.0.2, 7.6.7 and 7.4.9, with 7.2 users told to move to the 7.4 branch or later; and FortiAuthenticator 8.0.4 and 6.6.11. FortiSASE, the company's cloud security service, updates automatically, while FortiManager Cloud customers may need to install the update themselves.
Fortinet credited the findings to its program of security testing assisted by frontier AI models, which it uses to analyze code paths, protocol handling and configuration logic. It thanked Anthropic, OpenAI, Google and SpaceX for their collaboration but did not say which model found which flaw. Full advisories are to appear on Fortinet's product security incident response team (PSIRT) portal on Nov. 10, the company's next Patch Tuesday. As of Friday morning, the newest advisories listed on that portal were dated Oct. 13.
The notice tells customers to treat the release as a priority change rather than routine maintenance, to schedule maintenance windows for Oct. 22 and 23 starting with internet-facing devices, and to back up configurations first. Organizations that cannot upgrade immediately should limit HTTPS and SSH administrative access to trusted addresses or switch it off on external interfaces, keep FortiManager administration off the internet and require multifactor authentication for every administrator.
Why It Matters
Fortinet firewalls and VPN gateways sit at the edge of corporate networks, which heise noted makes them a frequent target. The Primary Wire reported earlier this month, citing BleepingComputer, that attackers were exploiting a critical FortiMail flaw before a fix was released.
The bigger shift is in timing. Fortinet's own argument is that a published patch shows attackers where the weakness was, and that AI tools can help them reverse-engineer fixes and build working exploits in hours or days, or chain minor bugs into a serious one. "The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking," Windsor wrote.
For boards, that means security teams may increasingly be asked to deploy fixes for flaws nobody outside the vendor can yet assess. Leaders should make sure patching policies allow emergency changes to edge devices on the vendor's word, and that teams know which internet-facing equipment comes first.
What to Watch
The Nov. 10 advisories should reveal how serious the flaws are and whether any can be exploited without a password. Before then, watch for signs that attackers have compared old and new builds to find the bugs, and for alerts from CISA, the U.S. Cybersecurity and Infrastructure Security Agency, or national computer emergency response teams. Also watch whether other vendors working with AI labs disclose similar batches of machine-found flaws.
