Fortinet’s October hardening release: what we did for SecureOS Managed Firewall clients

Short version: Fortinet released fixes on 22 October for critical and high-severity vulnerabilities across its main product lines. Every device under our SecureOS Managed Firewall service has been upgraded to a non-affected release in its weekly maintenance window. No action is needed from managed clients. If you run your own FortiGate, upgrade now.

What Fortinet announced

On 21 October (US time) Fortinet’s CISO, Carl Windsor, announced a coordinated security hardening release covering FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. The fixes address vulnerabilities Fortinet found through its own AI-assisted security testing, and Fortinet rates them critical and high severity.

Fortinet has not yet published CVE numbers or individual ratings. The public PSIRT advisories are scheduled for 10 November. That gap is deliberate: it gives customers time to patch before the details that help attackers build exploits are public. Fortinet’s own warning is that the window between disclosure and exploitation is shrinking, so treat this as a priority change, not a routine one.

Fixed versions

FortiSASE was updated automatically. FortiManager Cloud and public-cloud instances may need a manual update through the cloud provider’s release process.

What we did for SecureOS Managed Firewall clients

• Upgraded every managed device to a non-affected release during its scheduled weekly maintenance window, following our normal practice of proving the firmware on our lab unit first.
• Reduced the attack surface before the patch landed. Our build standard already keeps HTTPS administration off the WAN and limits remote SSH to Securitribe’s own addresses, so the management plane was not reachable from the internet while the window was open.
• Reviewed administrative access and configuration-change logs around the upgrade for anything unexpected.

If your firewall is under our management, there is nothing you need to do. Your next monthly report will show the firmware version and the change record.

If you manage your own FortiGate

1. Back up the configuration, then upgrade to the fixed version for your branch. Internet-facing devices first.
2. Until you can upgrade, restrict HTTPS and SSH administration to trusted addresses or turn them off on external interfaces, and keep FortiManager unreachable from the internet.
3. Enforce MFA and unique credentials on every administrator account.
4. Check logs for unusual administrative logins or unapproved configuration changes, both before and after patching.
5. Subscribe to FortiGuard PSIRT advisories for the 10 November details.

Fortinet is clear that the interim steps reduce risk but do not replace the upgrade.

Questions

Email [email protected]. If you would like your firewalls patched and managed on a cadence so this is handled before you read about it, see Managed FortiGate firewall.