Fortinet urges patching five products as CVE details delayed until Nov 10

Patch now, details later

Fortinet released security updates for five products and urged customers to update internet-facing devices immediately. Full vulnerability details and CVE IDs will not be published until November 10. Carl Windsor, Fortinet's Chief Information Security Officer, said customers should plan and promptly complete upgrades as soon as releases are available, prioritizing internet-facing devices.

The October 22 release covers FortiOS, FortiManager and FortiAnalyzer across the 7.2, 7.4, 7.6 and 8.0 branches. FortiMail and FortiAuthenticator patches were issued on October 21. Fortinet said this was the first release to include fixes identified through its frontier AI-assisted security testing program, as part of collaboration with vendors including Anthropic's Glasswing (Mythos) and OpenAI's Daybreak (GPT 5.5 Cyber) projects.

Experts warn of reverse engineering

Security experts warned attackers could study patches and exploit flaws before Fortinet releases details. Yordan Ganchev, principal threat intelligence specialist at watchTowr, said the vulnerabilities will likely be rapidly reverse-engineered, reproduced and exploited in the wild. He advised organizations running affected Fortinet devices to apply patches immediately and restrict or take offline internet-exposed Fortinet management interfaces.

Windsor cited the shrinking window between vulnerability disclosure and exploitation, and said disclosures can give hackers time to study vulnerabilities before defenders patch. He also warned attackers can use AI to chain unrelated lower-severity weaknesses into a more severe exploitable vulnerability. watchTowr said in September that the window had fallen from two weeks to four hours.

Context from recent flaws

Ganchev linked the concern to recent PHP2Shell critical remote code execution flaws and said all affected Fortinet products are high-value targets with a history of exploitation. He also said preemptively announcing big vulnerabilities coming soon only gets the industry and LLM patch-diffing harnesses ready. Cel Quintero posted fixed release versions and advice to restrict admin access to trusted IPs, keep FortiManager off the internet and enforce MFA if patching is not yet possible.

Sources: Cybernews