Fortinet Emergency Patches: FortiOS, FortiManager, FortiAnalyzer

Fortinet has released an out-of-band set of security hardening updates for its core products — FortiOS, FortiManager and FortiAnalyzer — covering critical and high-severity issues. The release follows earlier hardening updates for FortiMail and FortiAuthenticator, and Fortinet is telling customers to treat it as a priority change rather than a routine maintenance window.

For a Hong Kong SME running a FortiGate firewall, the practical question is simple: what version is your firewall on, and who is going to patch it? We can answer both — Potoco provides remote and on-site firmware remediation for FortiGate at a low fixed price. More on that below.

What was released

Published on 21–22 October 2026, the updates fix critical and high-severity vulnerabilities in the Fortinet operating system and management platforms. Fortinet has not yet published CVE identifiers or CVSS scores; the individual PSIRT advisories are expected on 10 November 2026. That delay is deliberate — it gives customers time to patch before technical details become public — but it also means you should not wait for a CVE number to act.

If your FortiGate is on any 7.2, 7.4, 7.6 or 8.0 build older than the version listed above, it is in scope. FortiManager Cloud and FortiSASE instances are updated by Fortinet automatically; public cloud instances follow the cloud provider’s release process.

Why Fortinet is calling this urgent

Fortinet’s CISO framed four reasons: the flaws are critical or high severity, AI now lets attackers reverse-engineer a patch and produce exploit code in hours rather than weeks, publishing updating binaries exposes exactly where to look, and AI can chain weaker flaws into a workable attack. The vulnerabilities were found partly through Fortinet’s own AI-assisted code review programme.

At the time of writing Fortinet says it has no confirmed reports of exploitation in customer environments. But internet-facing firewalls are the highest-value target on almost any network, and the window between patch release and working exploit is now measured in days.

If you cannot patch immediately

Patching the firmware is the only real fix. If a maintenance window is days away, reduce exposure in the meantime:

• Restrict HTTPS and SSH administrative access to trusted IPs — never leave admin interfaces open on the WAN side.
• Take FortiManager and FortiAnalyzer off the public internet entirely, or reach them through VPN only.
• Enforce MFA and unique credentials for every administrator account.
• Back up your configuration before any upgrade, and keep a copy off the device.
• Monitor logs for unusual admin logins or unexpected configuration changes, before and after patching.

Our remediation service: remote or on-site, low fixed price

Most Hong Kong SMEs do not have an in-house engineer free to plan a firmware upgrade in the middle of a working week. Potoco handles it for you:

• Remote hardening — we check your FortiOS, FortiManager and FortiAnalyzer versions against the fixed list, back up the configuration, upgrade during an agreed low-traffic window, and verify the firewall, VPN and policies afterwards.
• On-site remediation — for offices without a reliable remote path to the device, or where the upgrade needs a physical console session.
• Fixed, low pricing — a flat fee per device for the remote case, quoted up front, with no surprise hourly billing. If your configuration needs rebuilding rather than upgrading, we say so before we start.
• Post-upgrade check — VPN tunnels, web filtering, IPS and any custom policies confirmed working, plus the version written into your asset list.

Aged firewall or lapsed licence? We can upgrade you

Some FortiGates cannot simply be patched. Models that have reached end-of-support do not receive the fixed firmware, and a device without a valid licence cannot run the security services anyway — so it is protected by routing rules alone, not by threat inspection.

In that case an upgrade is the cheaper route. Potoco supplies and configures the current G-series models, with pricing that includes trading in effectively the old unit’s role rather than paying twice:

• FortiGate 50G — fanless entry model for small offices of roughly 10–25 users; the standard replacement for the 60E and 60F.
• FortiGate 70G — more throughput and sessions for growing offices running VPN and guest networks.
• FortiGate 90G — for 50–100 user sites, multiple WAN links and heavier inspection.

Larger sites can step up to the FortiGate 120G. If your current firewall is out of licence, ask us about the upgrade price rather than renewing an ageing box — renewing a model that no longer receives security fixes can cost more than moving to a current one. Our G-series upgrade guide walks through the comparison, and existing licence questions are covered on our license renewal page.

What to do this week

Check your FortiOS version (Dashboard → Status in the GUI, or get system status in the CLI). If it does not match the fixed version list, book an upgrade window. If you are not sure what you are running, or the device is no longer managed by anyone, send us the model and version and we will tell you free of charge whether you are affected, whether it can be patched, or whether an upgrade is the sensible path.

Contact Potoco Systems for a free assessment of your FortiGate exposure — remote or on-site remediation, and upgrade pricing for older models.

About Potoco Systems Limited

Potoco Systems is a Hong Kong-based IT service provider specializing in managed IT services, network security, and Microsoft 365 solutions. We help businesses streamline their IT operations with expert support and enterprise-grade technology.

Contact us:

• 📞 Phone: 2117-9474
• 💬 WhatsApp: +852 9036 5443
• ✉️ Email: sales@potocohk.com
• 🌐 Website: https://potocohk.com

Contact us today for a free consultation on your IT needs.