Fortinet Urges Immediate Upgrades After AI Discovers Critical Vulnerabilities Across Core Products

Fortinet has released security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator after AI-assisted testing uncovered multiple critical and high-severity vulnerabilities. While the company has patched the flaws, technical details will remain undisclosed until November 10, 2026, to give customers time to secure affected systems.

According to Fortinet Chief Information Security Officer Carl Windsor, the vulnerabilities were identified through a combination of frontier AI models and human validation. He warned that attackers now have access to similar AI tools and can use them to discover security weaknesses and develop exploits faster than ever before. Fortinet's decision to delay publication of technical details is intended to reduce the risk of attackers reverse-engineering the fixes and targeting organizations that have not yet applied updates.

The updates cover FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator. Customers running supported versions are being urged to upgrade immediately, particularly on internet-facing systems. Fortinet noted that some of the fixed issues carry critical and high severity ratings, suggesting that at least some vulnerabilities may be remotely exploitable under certain conditions.

Temporary risk-reduction measures include restricting administrative access to trusted IP addresses, keeping management interfaces off the public internet, using strong unique administrator credentials, and enforcing multi-factor authentication. However, Fortinet emphasized that these measures should only be considered temporary mitigations and are not substitutes for upgrading.

The company also highlighted a growing trend in AI-assisted vulnerability research. Initial testing focused on allowing AI models to analyze firmware without access to source code, mimicking the approach an attacker might take. While relatively few exploitable vulnerabilities were discovered through that process, Fortinet found the models were highly effective at comparing firmware versions and generating proof-of-concept exploit code for previously fixed vulnerabilities.

More substantial findings emerged when AI models were given access to source code. Across more than 100 security assessments covering 30 different product families, approximately 40% of AI-generated findings were confirmed vulnerabilities, 30% were false positives, and 30% identified opportunities for additional hardening that were not directly exploitable.

Fortinet stressed that the newly released updates are unrelated to the recently disclosed PHP2Shell vulnerabilities, confirming that FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator are not affected. The company nonetheless warned that attackers can increasingly use AI to combine multiple lower-severity flaws into more serious attack chains, making rapid patch adoption increasingly important for defenders.