Fortinet says patch now, details later, but experts warn of hacks before Nov 10 disclosure

Fortinet releases a “coordinated set of security updates” for three vulnerable products – FortiOS, FortiManager, and FortiAnalyzer – warning customers to update all internet-facing devices immediately, while disclosure details stay hidden until next month.

We strongly urge every customer to plan and promptly complete these upgrades as soon as the releases are available, prioritizing internet-facing devices,

said Carl Windsor, Chief Information Security Officer (CISO) at Fortinet, in an October 21st blog post.

Fortinet rolls out fixes across five products

The company said, for the first time, the release includes fixes “identified through our frontier AI-assisted security testing program,” as part of a collaboration with several vendors including Anthropic’s Glasswing (Mythos) and OpenAI’s Daybreak (GPT 5.5 Cyber) projects.

Fortinet released patches for the following affected products on October 22nd:

• FortiOS 7.2, 7.4, 7.6, and 8.0 branches
• FortiManager 7.2, 7.4, 7.6, and 8.0 branches
• FortiAnalyzer 7.2, 7.4, 7.6, and 8.0 branches

Patch releases covering FortiMail and FortiAuthenticator versions were issued on October 21st, including:

• FortiMail 7.2, 7.4, 7.6, and 8.0 branches
• FortiAuthenticator 6.6 and 8.0 branches

Fortinet withholds CVE details until Nov 10

What makes this release controversial is that the CVE IDs and full advisories on the product flaws will not be disclosed until November 10th, nearly three weeks after Fortinet issued the patches.

Three weeks without vulnerability information gives attackers and researchers a playground to go hunting, and secrecy and obscurity don’t help anyone.

We expect these vulnerabilities will be rapidly reverse-engineered, reproduced, and exploited in the wild.

warns Yordan Ganchev, principal threat intelligence specialist at watchTowr.

However, Windsor said several factors drove the decision to issue the patches early – including not wanting customers to treat the critical fixes as just another “Fortinet routine maintenance cycle.”

@Fortinet is urging customers to patch FortiOS, FortiManager and FortiAnalyzer: updates for critical and high-severity flaws are available October 22. No CVE IDs or active exploitation reported yet, public advisories come Nov 10. Fortinet's advice: don't wait for the details, patch internet-facing devices first. Fixed releases: - FortiOS: 8.0.2, 7.6.8, 7.4.13, 7.2.14 - FortiManager / FortiAnalyzer: 8.0.2, 7.6.8, 7.4.12, 7.2.13 Can't patch yet? Restrict admin access to trusted IPs, keep FortiManager off the internet, enforce MFA. It reduces exposure, it doesn't replace the update. #fortinet #fortios #HellNRockLabs

undefined Cel Quintero 𝕏 (@Cel_Metal_) October 22, 2026

Another argument for early patch release Windsor cites is the incredible shrinking window between vulnerability disclosure and exploitation due to the recent proliferation of AI tools among threat actors.

In September, watchTowr declared that window had fallen from two weeks to just four hours.

Building on that fear, Fortinet says disclosures often give hackers time to study a vulnerability's inner workings before defenders have a chance to patch.

AI? Never heard of them. https://t.co/LOBGEFL2w6

undefined watchTowr (@watchtowrcyber) September 23, 2026

Known as "patch diffing," the attacker uses a comparison tool to compare both the patched and unpatched versions of the affected software, enabling them to identify specific code changes that allow for reverse engineering.

Windsor also warned that with AI, hackers can now chain together unrelated, lower-severity weaknesses to create “a more severe, exploitable vulnerability.”

Hackers could beat Fortinet to disclosure

The security patching world has been in full swing since researchers uncovered two critical RCE flaws – dubbed PHP2Shell – that could allow attackers to run malicious code on vulnerable servers – potentially impacting millions of websites.

As the PHP coding language powers almost 70% of websites worldwide, there have been widespread fears hackers will “diff” the vulnerability before defenders patch their systems.

Yordan Ganchev, principal threat intelligence specialist at watchTowr, which played a significant role in the PHP2Shell disclosure, acknowledges the constant stream of disclosures defenders have had to face this week.

“Face-melting vulnerabilities like PHP2Shell and other vulnpocalypse entries from frequent contributors like Cisco, Oracle, and GitLab, to name a few. And if we put aside all the supply-chain poisoning attacks, anyone might think their week can only get better if they didn’t have Fortinet,” Ganchev says.

All of the affected [Fortinet] products are high-value targets. Most of them have a long history of exploitation and a proven track record of being CISA KEV honorary (and repeat) customers,

says Yordan Ganchev, principal threat intelligence specialist at watchTowr.

The watchTowr principal says if there was anything learned from this week’s PHP chaos, “it's that preemptively announcing ‘big vulnerabilities coming soon’ only gets the industry and their LLM patch-diffing harnesses ready.”

Ganchev reiterates that any organization running affected Fortinet devices should apply the patches immediately – further advising those with “internet-exposed Fortinet management interfaces to take them offline or restrict access to them.”