Fortinet patches critical FortiOS flaws found with AI help

Fortinet has quietly shipped security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, but won't disclose the specific flaws being fixed until November 10, 2026. According to CISO Carl Windsor, the bugs were discovered using frontier AI models combined with human validation, and some are rated critical or high severity, meaning several could potentially be exploited remotely without authentication. Fortinet warns that attackers also use AI to hunt for vulnerabilities and chain minor issues into serious exploits, so the gap between patch release and active exploitation keeps narrowing. Admins are urged to update immediately rather than wait for the full disclosure, prioritizing internet-facing systems; fixed versions exist for FortiOS/FortiManager/FortiAnalyzer 8.0, 7.6, 7.4, 7.2, FortiMail 8.0, 7.6, 7.4, and FortiAuthenticator 8.0, 6.6. These updates are unrelated to the recently disclosed PHP2Shell vulnerabilities, which do not affect these products.