Fortinet November 2026 fixes: FortiGate, FortiMail and FortiClient

Fortinet published 88 security advisories on 10 November 2026, and 19 of them are rated critical. They cover FortiGate firewalls (FortiOS), FortiMail, FortiClient, FortiManager, FortiAnalyzer and FortiAuthenticator. Fortinet marks every one of them as not known to be exploited, so this is not an emergency. If your office has a FortiGate, ask whoever looks after it to plan a firmware update in the next few weeks.

What did Fortinet fix?

Most of the advisories are for FortiManager and FortiAnalyzer, the tools larger companies and IT vendors use to run many FortiGates from one screen. A small office usually has only the firewall, and sometimes FortiClient on staff laptops.

For FortiOS, the software inside every FortiGate, there are eight advisories in this batch. Three are critical. One affects FortiGates set up in certain high availability modes (FGSP with config sync, or autoscale), where Fortinet says an attacker on the nearby network could run commands as the top admin. Two are in the OSPF and BGP routing features, so they matter only if your FortiGate uses them. Others cover the SSH login, the SSL VPN web portal and two-step login for admins who sign in through a RADIUS server.

Fortinet lists these fixed FortiOS versions. The newest release in each line covers all eight advisories:

These tables only list the 7.2, 7.4, 7.6 and 8.0 lines. If your box runs an older line, ask your vendor which upgrade path Fortinet supports for it.

FortiClient for Windows and Mac has one critical flaw that needs the user to take an action, such as opening a link, before it can be used. Fortinet's fix is version 7.4.8, or 7.2.15 on Windows.

FortiMail, Fortinet's email security box, has eight of the critical items, several of them in the secure webmail (IBE) part. The fixed versions are 8.0.2, 7.6.7 and 7.4.9. For FortiMail 7.2, Fortinet says to move to a fixed release. Fortinet says FortiMail Cloud was already updated by them and customers do not need to do anything.

Is any of it being attacked?

Not as of 11 November 2026. Each advisory shows "Known Exploited: No", and none of them is on the US CISA list of holes attackers are using. That can change quickly once fixes are public, so it is best not to leave this for months.

What to do

1. Find out who manages your FortiGate. It is often the vendor that sold or installed it, or your IT person.
2. Ask them to check the firmware version. It shows on the FortiGate dashboard after you log in.
3. Ask them to back up the configuration first, then update in a maintenance window, for example after office hours. The box restarts during the update, so expect the internet and VPN to drop for a few minutes.
4. Make sure the FortiGate admin login cannot be reached from the internet. Admin access should only work from inside the office or over the VPN. If it is open to the internet, close it now, even before the update.
5. If staff use FortiClient for VPN, update it on every laptop to the version above.
6. If your mail runs through a FortiMail box, ask your vendor to update it to one of the fixed versions.

We wrote about basic router and firewall checks in an earlier note on FortiGate and MikroTik, which is still a good list to go through after the update.

Source and credit

We are sharing this news from Fortinet and CISA. This summary is written by Synctech in our own words.

• PSIRT Advisories list, Fortinet FortiGuard Labs, 10 November 2026: https://fortiguard.fortinet.com/psirt
• FG-IR-26-273, Unauthenticated adjacent command execution via HA, Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-273
• FG-IR-26-267, Authentication bypass by primary weakness (FortiOS), Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-267
• FG-IR-26-268, Numeric truncation error (FortiOS), Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-268
• FG-IR-26-269, ssh daemon flaw (FortiOS), Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-269
• FG-IR-26-270, Out-of-bounds read in kernel (FortiOS), Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-270
• FG-IR-26-193, SSLVPN Improper Certificate Validation, Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-193
• FG-IR-26-195, Broken Access Control in Two-Factor-Authentication, Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-195
• FG-IR-26-194, Origin validation error in local API endpoint (FortiClient), Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-194
• FG-IR-26-199, Path traversal (FortiMail), Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-199
• FG-IR-26-207, Incorrect authorization (FortiMail), Fortinet, 10 November 2026: https://fortiguard.fortinet.com/psirt/FG-IR-26-207
• Known Exploited Vulnerabilities Catalog, CISA, checked 11 November 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Retrieved 11 November 2026. Fortinet, FortiGate, FortiOS, FortiMail, FortiClient, FortiManager, FortiAnalyzer and FortiAuthenticator are trademarks of Fortinet Inc. MikroTik is a trademark of its owner. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.