Fortinet releases critical security updates across multiple products

Fortinet has announced critical vulnerabilities affecting a range of its products and is urging customers to apply security updates as a priority.

Affected products include multiple versions of FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Fortinet said affected versions of FortiSASE have already had security updates applied automatically, but FortiManager products may require manual updates.

A comprehensive list of affected products and fixed versions is available via Fortinet's official guidance.

The Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC) said it is monitoring the situation but has no further details beyond Fortinet's current public advice. The ASD's ACSC said it is not currently aware of active exploitation related to these vulnerabilities in Australia.

Fortinet is expected to release further information on 10 November 2026.

The ASD's ACSC is advising individuals and organisations to identify Fortinet products within their environments, apply available security updates, and monitor Fortinet's official guidance for evidence of exploitation activity.

Where security updates cannot be applied immediately, Fortinet has recommended organisations reduce their exposure by restricting administrative interfaces - including HTTPS and SSH - to trusted IP addresses, or disabling them on external interfaces.

Fortinet also advised ensuring FortiManager administration is not reachable from the internet, and that organisations implement strong credentials and mandate multi-factor authentication (MFA) on user accounts.