Fortinet 2026-yil 22-oktabrga rejalashtirilgan FortiOS, FortiManager va FortiAnalyzer uchun muvofiqlashtirilgan xavfsizlik mustahkamlash yangilanishlarini e'lon qildi.
Ushbu yangilanishlar muhim va yuqori darajadagi zaifliklarni bartaraf etishga qaratilgan. Kompaniya mijozlarga internetga ulangan tizimlarni yangilashni ustuvor qilishni va bu yangilanishlarni odatiy texnik xizmat emas, balki shoshilinch deb hisoblashni tavsiya qiladi.
21-oktabrdagi e'londa Fortinetning Axborot xavfsizligi bo'yicha bosh direktori Karl Vindzor (Carl Windsor) aytishicha, bu relizlar ilg'or sun'iy intellekt yordamida o'tkazilgan xavfsizlik sinovlaridan olingan tuzatishlarni o'z ichiga oladi. FortiMail va FortiAuthenticator uchun yangilanishlar ushbu muvofiqlashtirilgan relizdan oldin chiqariladi.
Fortinetning ta'kidlashicha, ilg'or sun'iy intellekt modellari kod yo'llarini, protokol ishlovini va konfiguratsiya mantiqini an'anaviy sinov usullaridan ko'ra samaraliroq tekshirib, zaifliklarni aniqlay oladi. Kompaniya bu ishga Anthropic, OpenAI, Google va SpaceX hissalarini tan oladi.
Fortinetning avval e'lon qilingan sinov metodologiyasi proshivka tahlili, tahdid modellashtirish, manba kodini ko'rib chiqish va jonli penetratsiya sinovlarini o'z ichiga oladi, bunda inson tahlilchilari sun'iy intellekt natijalarini tasdiqlab, ularni belgilangan zaiflikni baholash jarayoni doirasida saqlaydi.
Sun'iy intellektning hujum salohiyati ham ushbu yangilanishlarning shoshilinchligini ta'kidlaydi. Fortinet ogohlantirishicha, hujumchilar yamoqlarni teskari muhandislik qilib, bir necha soat yoki kun ichida eksploitlar ishlab chiqishi mumkin.
Ommaviy proshivka o'zgarishlari yamoqlarni solishtirish orqali zaif kodni fosh qilishi mumkin, sun'iy intellekt esa past darajadagi zaifliklarni jiddiyroq hujumlarga birlashtirishga yordam berishi mumkin.
E'lon qilingan minimal tuzatilgan versiyalar to'rtta tarmoqni qamrab oladi:
| Mahsulot | 8.0 tarmoq | 7.6 tarmoq | 7.4 tarmoq | 7.2 tarmoq |
|---|---|---|---|---|
| FortiOS | 8.0.2 | 7.6.8 | 7.4.13 | 7.2.14 |
| FortiManager | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
| FortiAnalyzer | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
Ta'sirlangan versiyalar har bir ro'yxatdagi tarmoqning dastlabki relizidan to tuzatilgan relizdan oldingi versiyagacha bo'lgan oraliqni o'z ichiga oladi.
FortiMail mijozlari o'z tarmoqlari doirasida 8.0.2, 7.6.7 yoki 7.4.9 va undan yuqori versiyalarga yangilanishi kerak. 7.2 versiyasidagi FortiMail o'rnatmalari 7.4 yoki undan yuqori versiyaga ko'chirilishi lozim. FortiAuthenticator uchun tuzatishlar 8.0.4 va 6.6.11 yoki undan yuqori versiyalarda mavjud.
E'londa alohida CVE'lar, CVSS ballari, ekspluatatsiya shartlari yoki tasdiqlangan hujumlar ko'rsatilmagan. Ommaviy maslahatlar 10-noyabrda Fortinetning PSIRT portali orqali e'lon qilinishi rejalashtirilgan.
Fortinet tashkilotlarga avvalo ochiq tizimlarni yamoqlashni, 22–23-oktabr kunlari texnik xizmat oynalarini ustuvor qilishni tavsiya qiladi.
Administratorlar o'z o'rnatmalarini inventarizatsiya qilishi, konfiguratsiyalarni zaxiralashi va yangilanishdan oldin va keyin g'ayrioddiy ma'muriy kirish yoki ruxsatsiz konfiguratsiya o'zgarishlarini kuzatishi kerak.
Agar darhol o'rnatish mumkin bo'lmasa, tashkilotlar quyidagilarni amalga oshirishi lozim:
- HTTPS va SSH kirishni ishonchli IP manzillarga cheklash.
- Tashqi interfeyslardan ma'muriy kirishni olib tashlash.
- FortiManager ma'muriyati internet orqali kirish mumkin emasligiga ishonch hosil qilish.
- Ko'p omilli autentifikatsiya va kuchli, noyob administrator ma'lumotlarini joriy etish.
- Tashqi boshqaruv, VPN yoki SASE izolyatsiyasi va tegishli virtual yamoqlardan foydalanish.
Ushbu nazorat choralari ta'sirni kamaytirsa-da, ular yangilanish zaruratini almashtirmaydi.
FortiSASE relizdan oldin avtomatik yangilanishi rejalashtirilgan. FortiManager Cloud qo'lda yangilanishni talab qilishi mumkin, ommaviy bulut o'rnatmalari esa o'z provayderlarining reliz jarayonlariga rioya qilishi kerak.
Fortinet has announced coordinated security hardening updates for FortiOS, FortiManager, and FortiAnalyzer, scheduled for October 22, 2026.
These updates aim to address critical and high-severity vulnerabilities. The company urges customers to prioritize updating internet-facing systems and treat these upgrades as urgent, not routine maintenance.
In an announcement on October 21, Fortinet’s Chief Information Security Officer, Carl Windsor, said the releases will include fixes derived from frontier AI-assisted security testing. Updates for FortiMail and FortiAuthenticator will precede this coordinated rollout.
Fortinet says frontier AI models can examine code paths, protocol handling, and configuration logic to identify weaknesses more efficiently than traditional testing methods. The company acknowledges contributions from Anthropic, OpenAI, Google, and SpaceX to this work.
Fortinet’s previously published testing methodology combines firmware analysis, threat modeling, source code review, and live penetration testing, with human analysts validating findings to keep AI-generated results within an established vulnerability assessment process.
AI’s offensive potential also underscores the urgency of these updates. Fortinet warns that attackers can reverse-engineer patches and develop exploits within hours or days.
Public firmware changes may expose vulnerable code through patch comparisons, and AI can help chain lower-severity weaknesses into more significant attacks.
The announced minimum fixed versions span four branches:
| Product | 8.0 branch | 7.6 branch | 7.4 branch | 7.2 branch |
|---|---|---|---|---|
| FortiOS | 8.0.2 | 7.6.8 | 7.4.13 | 7.2.14 |
| FortiManager | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
| FortiAnalyzer | 8.0.2 | 7.6.8 | 7.4.12 | 7.2.13 |
Affected versions range from each listed branch’s initial release up to the version immediately preceding its fixed release.
FortiMail customers should upgrade to version 8.0.2, 7.6.7, or 7.4.9 or later within their respective branches. FortiMail deployments on version 7.2 must migrate to version 7.4 or later. Fixes for FortiAuthenticator are available in versions 8.0.4 and 6.6.11 or later.
The announcement does not specify individual CVEs, CVSS scores, exploitation prerequisites, or confirmed attacks. Public advisories are scheduled for release on November 10 through Fortinet’s PSIRT portal.
Fortinet recommends thatorganizations patch exposed systems first, with maintenance windows prioritized for October 22–23.
Administrators should inventory their deployments, back up configurations, and monitor for unusual administrative access or unauthorized configuration changes before and after performing upgrades.
Where immediate installation is not feasible, organizations should:
- Restrict HTTPS and SSH access to trusted IP addresses.
- Remove administrative access from external interfaces.
- Ensure FortiManager administration is not accessible via the internet.
- Enforce multifactor authentication and strong, unique administrator credentials.
- Utilize out-of-band management, VPN or SASE isolation, and applicable virtual patches.
While these controls reduce exposure, they do not replace the need for upgrades.
FortiSASE is scheduled for automatic updates before the rollout. FortiManager Cloud may require manual updates, while public cloud deployments must adhere to their providers’ release processes.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.