Fortinet urges urgent patching after AI-found flaws

Fortinet has issued a coordinated set of security updates for FortiOS, FortiManager and FortiAnalyser to address critical and high-severity vulnerabilities.

The updates follow recent releases for FortiMail and FortiAuthenticator, extending the company's latest hardening effort across several core products used by enterprise and service provider customers.

Customers are being urged to treat the rollout as a priority change rather than a routine maintenance cycle, with internet-facing devices at the front of the queue. Organisations should also prepare inventories of exposed systems, back up configurations and monitor logs for unusual administrative access or unauthorised configuration changes before and after patching.

The release covers multiple software branches. For FortiOS, affected versions in the 8.0, 7.6, 7.4 and 7.2 lines receive fixes in versions 8.0.2, 7.6.8, 7.4.13 and 7.2.14 or later. FortiManager and FortiAnalyser receive corresponding patched versions across the same major branches, while FortiMail and FortiAuthenticator have already been updated in their supported lines.

AI testing

A notable feature of the latest fixes is how they were identified. Fortinet said some vulnerabilities were found through its use of frontier AI models in product security testing, alongside more established methods.

According to the company, the models were used to analyse code paths, protocol handling and configuration logic. Fortinet said this approach helped surface weaknesses before attackers could find and exploit them, while warning that similar AI tools are becoming more accessible to threat actors.

That warning underpins the company's emphasis on speed. It said the gap between disclosure and exploitation is narrowing, in part because AI can help adversaries reverse-engineer patches and develop working exploits more quickly.

Fortinet also highlighted the risk of patch diffing, where attackers examine code changes in released updates to identify the underlying flaw. In that scenario, systems left unpatched after an update becomes public can become easier targets. It added that AI can also help chain lower-severity vulnerabilities into more serious attacks.

Immediate steps

For customers unable to patch immediately, Fortinet recommended limiting exposure by managing devices out of band where possible, moving resources behind VPN or SASE environments, and applying virtual patches until full upgrades can be completed.

It also called for tighter control over administrative interfaces such as HTTPS and SSH, saying they should be restricted to trusted IP addresses or disabled on external interfaces. FortiManager administration, the company said, should not be reachable from the public internet.

The guidance also includes standard account security measures, including strong, unique credentials and multi-factor authentication for all administrator accounts. Fortinet said these measures can reduce risk in the short term but do not replace timely upgrades.

Product coverage

The hardening effort spans network security, management and analytics products. In addition to the updates for FortiOS, FortiManager and FortiAnalyser, FortiSASE will be updated automatically, while FortiManager Cloud releases will be available for update and may require manual action in some cases. Updates for public cloud instances are being distributed through relevant cloud partners under their standard release processes.

Public advisories for the vulnerabilities are due to be published later through Fortinet's Product Security Incident Response Team process. The company said it was balancing transparency with customer security by providing patches ahead of broader public disclosure.

That sequencing reflects a wider debate in cyber security over responsible disclosure, particularly when vendors fear exploit development can follow quickly after technical details become public. In this case, Fortinet is urging customers to use the window before advisory publication to complete upgrades and reduce the number of exposed systems.

Fortinet thanked Anthropic, OpenAI, Google and SpaceX for collaborating on the AI-assisted testing programme.

"We strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices," said Carl Windsor, Chief Information Security Officer at Fortinet.

"We recommend customers treat this release as a priority change rather than a routine maintenance cycle," Windsor said.