74 openlast updated

HomeOctober 2026 patch cycleFortiOS 7.6.8, 7.4.13: October 2026 hardening release

Patch nowEnterprisefrom 2026-10

FortiOS 7.6.8, 7.4.13: October 2026 hardening release

Part of October 2026 patch cycle

Vendor
Fortinet
Products
FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiAuthenticator, and FortiClient
Published
· updated
Status
Open

Update, Nov 10: the CVEs are out, and one of them isn’t fixed in the hardening build. Fortinet published 89 advisories on November 10: 19 Critical, 67 High and 3 Medium. Every one says “Known Exploited: No.” Nothing is in KEV yet. The call stays Patch now, and the clock that matters starts today, because the bug descriptions are now public. The ones to read first:

  • FG-IR-26-219, CVE-2026-126170 (9.8, unauthenticated): code execution through the JSON API on FortiManager and FortiAnalyzer 8.0 and 7.6. 7.6.8 fixes it. 8.0.2 doesn’t. Fortinet lists 8.0.0 through 8.0.2 as affected and the fix as “upcoming 8.0.3.” The JSON API is off by default. If you turned it on, the workaround is set rpc-permit none under config system admin profile for each profile that has it. If you went to 8.0.2 on October 22, you’re still exposed.
  • FG-IR-26-275, CVE-2026-126261 (9.0, unauthenticated): code execution on FortiManager by anyone who can reach the FGFM port.
  • FG-IR-26-274 and 26-276 (9.0 and 9.3): SSRF and SQL injection in FortiAnalyzer, and FortiManager with analyzer features, through the OFTP port.
  • FG-IR-26-273, CVE-2026-126259 (9.0): unauthenticated commands as super admin on FortiOS through crafted HA packets, when FGSP with standalone-config-sync or autoscale is in use.
  • FG-IR-26-267 and 26-268 (9.3 and 9.6): FortiOS OSPF and BGP daemon bugs. Not on the admin interface, so restricting admin access doesn’t cover them.
  • FortiMail: seven criticals, including unauthenticated code execution (FG-IR-26-199 and 26-200, both 9.8; FG-IR-26-216, 9.4) and IBE webmail account takeovers (FG-IR-26-202, 26-207, 26-208, 26-209). FG-IR-26-202 still lists 7.2 as “upcoming 7.2.10,” and most of the others tell 7.2 users to migrate.
  • FortiAuthenticator: two criticals (FG-IR-26-265 and 26-271, a hard-coded password), fixed in 8.0.4 and 6.6.11.
  • New since October: FortiClient. FG-IR-26-194 (9.1, needs user interaction) is fixed in FortiClient Windows and Mac 7.4.8 and FortiClient Windows 7.2.15. It wasn’t in the October list, so check your endpoint versions too.

Eight advisories still point to an “upcoming” release for at least one branch. Some FortiManager and FortiAnalyzer advisories also give different fixed versions than the October table, for example FG-IR-26-275 fixes FortiManager 7.4 in 7.4.6. Go by each advisory, not by our table below. (FortiGuard PSIRT RSS, FG-IR-26-219, FG-IR-26-275, FG-IR-26-273, FG-IR-26-199, FG-IR-26-202, FG-IR-26-194)

The original post follows.

Call: Patch now. Fortinet says these releases fix critical and high-severity vulnerabilities found by its AI-assisted testing, and asks customers to treat them “as a priority change rather than a routine maintenance cycle.” You get the fixes now and the CVEs later: the advisories, CVE IDs and scores are due on November 10. The bet is that you’ll patch before anyone diffs the builds. watchTowr told Cybernews it expects the bugs to be “rapidly reverse-engineered, reproduced, and exploited in the wild.”

Is it exploited? Not reported. As of October 23, Rescana found no exploitation reports from Fortinet or the national CERTs it checked, and no KEV entry. NHS England rates its alert Medium.

Fixed versions:

Product Affected Fixed
FortiOS 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.12, 7.2.0-7.2.13 8.0.2, 7.6.8, 7.4.13, 7.2.14
FortiManager / FortiAnalyzer 8.0.0-8.0.1, 7.6.0-7.6.7, 7.4.0-7.4.11, 7.2.0-7.2.12 8.0.2, 7.6.8, 7.4.12, 7.2.13
FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9 8.0.2, 7.6.7, 7.4.9 (7.2: move to 7.4)
FortiAuthenticator 8.0.0-8.0.3, 6.6.0-6.6.10 8.0.4, 6.6.11

FortiSASE was updated for you.

Who’s hit: Everyone on those versions. Start with anything that has an admin interface facing the internet.

What breaks when you upgrade: The patches carry their own known issues, so read the release notes before you go. On 7.6.8:

  • 1338764: admin SAML SSO fails. Make sure you have a working non-SSO admin before you upgrade. We have a separate post on this one.
  • 1353958: deep inspection on non-standard HTTPS ports misbehaves in all the hardening builds.
  • 1353422: 1800F and 1801F drop traffic on SFP ports.
  • 1353040: 370xF and 480xF interfaces stay down.
  • 1353401: ARP announcements are dropped on virtual-wire-pair members.

Fortinet hasn’t given a date for 7.6.9.

Workaround: Upgrade. Until then, restrict HTTPS and SSH admin access to trusted IPs or turn it off on external interfaces, keep FortiManager off the internet, and enforce MFA for admins. That shrinks your exposure. It doesn’t replace the patch.

Sources: Fortinet CISO Collective, Rescana, NHS England CC-4879, Cybernews, FortiOS 7.6.8 known issues.

Sources

More from October 2026 patch cycle