Fortinet patches critical FortiOS flaws found with AI help
Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026.
The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Officer Carl Windsor explained in the advance announcement. But attackers also have access to AI tools, he warned, and can use them to find vulnerabilities and build exploits.
“The window between disclosure and exploitation continues to shrink, and we expect it to keep shrinking,” he noted. “Once updates are public, the fixes themselves reveal where changes were made, exposing a potential system weakness. Unpatched devices then become easier targets for attackers.”
Why administrators should upgrade now
In the chaos that followed last week’s disclosure of the PHP2Shell vulnerabilities, Fortinet’s announcement and the security hardening updates perhaps didn’t get the attention they would usually get.
Fortinet devices are a favorite target for attackers, and the newly fixed vulnerabilities have been rated critical and high severity by Fortinet, which means that at least some may be remotely exploitable without prior authentication.
On top of that, the vendor warns that AI can “link seemingly unrelated lower severity vulnerabilities together to achieve a more severe, exploitable vulnerability.”
Fixed versions are available for the following branches:
- FortiOS, FortiManager, FortiAnalyzer 8.0, 7.6, 7.4 and 7.2
- FortiMail 8.0, 7.6 and 7.4 (customers using FortiMail 7.2 should upgrade to 7.4 branch or later).
- FortiAuthenticator 8.0 and 6.6
Administrators who haven’t yet upgraded are advised to do so now, because attackers won’t wait for November 10.
Updating internet-facing systems should be prioritized, Fortinet advises. And while the company says exposure to attack can temporarily be reduced by limiting admin access to trusted IP addresses, keeping FortiManager off the internet, using strong unique credentials, and enforcing MFA for admin accounts, these measures are no substitute for upgrading, Windsor noted.
The security hardening updates don’t contain fixes for the PHP2Shell vulnerabilities, because FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator aren’t affected.
How AI helped find the flaws
Fortinet has been using frontier AI models, alongside its own on-premises models, in its security testing process for several months.
It started by testing its products the way an attacker would: without access to the source code. The models analyzed the firmware, mapped out how it works and where it could be attacked, and the resulting leads were then checked through penetration testing and red teaming.
This approach turned up few exploitable vulnerabilities, but it also revealed that AI models are good at comparing firmware versions and building proof-of-concept exploits for vulnerabilities that had already been fixed – which is exactly why Windsor urged customers not to delay upgrading.
The bulk of the findings came when Fortinet pointed the models at its own source code (which attackers don’t normally have access to). Across more than 100 tests of 30 product families, about 40% of the findings were real vulnerabilities, 30% were false positives, and 30% were opportunities to improve security (but weren’t exploitable flaws).
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
