ASD raises alert for critical vulnerabilities in Fortinet products

The Australian Signals Directorate has raised a critical alert after Fortinet announced critical vulnerabilities in a wide range of its products. Fortinet is advising customers to complete the security updates as a priority. The alert is intended for all organisations using Fortinet products.

The Australian Signals Directorate's Australian Cyber Security Centre (ASD’s ACSC) is monitoring the situation but has no further details beyond Fortinet’s current public advice. Fortinet is expected to release more information 10 November 2026.

Fortinet has announced that multiple versions of FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator are affected. A comprehensive list of affected products and fixed versions can be found on Fortinet’s web site.

Fortinet have advised affected versions of FortiSASE have already had security updates applied automatically but FortiManager products may require manual updates.

ASD’s ACSC is currently not aware of active exploitation related to these vulnerabilities in Australia.

Mitigation advice

The ACSC advises individuals and organisations to:

• identify Fortinet products within their environments
• apply available security updates
• monitor and review Fortinet official guidance
• continue to monitor Fortinet products for evidence of exploitation activity.
   

Where the relevant security updates are unable to be implemented immediately, Fortinet have recommended customer reduce exposure by:

• restricting administrative interfaces (HTTPS, SSH) to trusted IP addresses or disable them on external interfaces
• ensuring FortiManager administration is not reachable from the internet
• implementing strong credentials and mandating multi-factor authentication on user accounts.
   

Organisations that have been impacted, suspect impact or require advice and assistance can contact them via 1300 CYBER1 (1300 292 371), or at www.cyber.gov.au/submit-a-report.

Image credit: iStock.com/sankai