Fortinet Patches Critical FortiOS Vulnerabilities Discovered With AI Assistance
Fortinet has released security updates for critical vulnerabilities in FortiOS and other products, discovered with the aid of AI, with details to be disclosed on November 10.
Fortinet has issued security hardening updates for several of its key products, including FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator. While the vendor has not yet disclosed the specific details of the vulnerabilities addressed, it has announced that full information, including CVE identifiers, will be made public on November 10, 2026. This proactive approach aims to give customers time to patch before exploit details become widely available.
These critical and high-severity vulnerabilities were uncovered through a combination of artificial intelligence models and human validation. Carl Windsor, Fortinet's Chief Information Security Officer, highlighted the evolving threat landscape, noting that AI is increasingly being used by both defenders to find flaws and by attackers to develop exploits. He emphasized that the time between vulnerability disclosure and exploitation is shrinking, making prompt patching essential.
Windsor warned that once patches are released, the changes made to fix the vulnerabilities can inadvertently reveal system weaknesses. This makes unpatched devices more susceptible to exploitation. Furthermore, he pointed out that attackers can leverage AI to chain together seemingly less severe vulnerabilities, creating more potent and exploitable security gaps.
Administrators are strongly advised to upgrade their affected Fortinet systems immediately, as attackers are unlikely to wait for the official November 10 disclosure date. Fortinet recommends prioritizing internet-facing systems for updates. While temporary mitigation strategies such as limiting administrative access to trusted IP addresses, keeping FortiManager offline, enforcing strong credentials, and implementing multi-factor authentication are suggested, they are not a substitute for applying the necessary patches.
Fortinet's security hardening updates do not address the recently disclosed PHP2Shell vulnerabilities, as the affected Fortinet products are not susceptible to those specific flaws. This distinction is important for administrators managing their security posture across various vendors and products.
The use of AI in vulnerability discovery has become a significant development. Fortinet has been integrating advanced AI models, both frontier and on-premises, into its security testing processes for several months. Initially, they employed an attacker-like methodology, analyzing firmware without source code access to identify potential attack vectors. This approach yielded some leads, which were then validated through penetration testing and red teaming.
While this method initially uncovered few exploitable vulnerabilities, it demonstrated AI's capability in comparing firmware versions and generating proof-of-concept exploits for already-fixed vulnerabilities. The most significant findings, however, emerged when Fortinet directed AI models to analyze its own source code. Across more than 100 tests on 30 product families, approximately 40% of the AI's findings were confirmed as genuine vulnerabilities, with 30% being false positives and the remaining 30% representing opportunities for security enhancements rather than exploitable flaws.