# Fortinet Security Updates: What Australian Businesses Should Check > The ACSC has issued a critical alert covering several Fortinet product families. Businesses should establish which devices need updates and who will complete them. - Canonical URL: https://techxtelco.com/news/fortinet-critical-security-updates-october-2026/ - Published: 2026-10-24 - Updated: 2026-10-24 - Topics: Technology, Security, News - Author: David Everson - Image: https://anrkjmgqmwfosbvyzrzc.supabase.co/storage/v1/object/public/article-images/fortinet-critical-security-updates-october-2026/hero-v1.webp - Publisher: Tech X Telco (https://techxtelco.com) Australian businesses using Fortinet products should check their update status after ASD’s Australian Cyber Security Centre issued a critical alert on 23 October. The alert covers several product families and urges organisations to apply available security updates, identify affected systems and continue monitoring for signs of exploitation. **Quick answer** Ask your IT team or managed service provider for a product-by-product answer. An automatically updated cloud service does not establish that every Fortinet device or management system in your business has been patched. Prioritise confirmation of internet-facing systems and their management access. ## Which Products Are Covered The ACSC names FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Fortinet’s release notice provides affected-version and fixed-version tables for each family. Match the exact product and software branch to that table rather than assuming one upgrade number applies to everything. For FortiOS, Fortinet lists fixes in 8.0.2, 7.6.8, 7.4.13 and 7.2.14, or later releases in the relevant branches. That is a reference for the affected FortiOS branches, not a universal upgrade instruction for other products. The appropriate path for an individual appliance should be confirmed by its administrator. If your supplier manages the equipment, request an inventory that links each affected service to its product name, installed release and proposed fixed release. Our recommendation is to use that record to track completion. A statement that the network has been checked is less useful than confirmation identifying what was checked and what changed. ## Cloud Services Need Separate Answers The ACSC says affected FortiSASE versions have received updates automatically, while FortiManager products may need manual updates. Fortinet specifically says FortiManager Cloud releases may require a manual update, and public-cloud instances follow the relevant cloud partners’ release processes. The practical question is therefore who owns each update. A business might have one team managing connectivity and another looking after the management platform. Assign a person to gather the responses and follow up any missing confirmation, rather than assuming an update to one part of the service covers the rest. ### Questions for Your IT Provider - Which systems are affected? Ask for the product, deployment type, current software branch and the applicable entry in Fortinet’s table. - What has been completed? Request a completion time and fixed release for each system, with outstanding work listed separately. - Who controls cloud updates? Identify which services update automatically and which require a customer, provider or cloud-platform action. - What evidence will you retain? Keep the change record and confirmation with your service documentation so the outcome can be checked later. ## What to Do While Updates Are Arranged Fortinet recommends backing up configurations before upgrading and reviewing logs for unusual administrative access or unauthorised configuration changes. If patching cannot happen immediately, its interim advice includes restricting administrative access to trusted IP addresses, keeping FortiManager administration off the public internet, and using strong credentials with multifactor authentication. These are administrator tasks that need to fit the existing environment. Forward the official notice and ask the responsible team to document the temporary measures it chooses. Fortinet is explicit that reducing exposure does not replace a timely upgrade; a mitigation should have an owner and a follow-up patching plan. The ACSC says it is not aware of related active exploitation in Australia. That statement describes the agency’s awareness at the time of the alert, not proof that an individual system is unaffected. The agency also says further public detail is expected on 10 November, so waiting for fuller technical disclosure is not the recommended update strategy. For a small business, the immediate job is coordination: identify the person responsible, obtain the inventory and ask for a clear completion report. If an update is delayed, record the reason and the next decision point. That gives the owner something concrete to follow up without attempting unfamiliar network changes personally. ## Sources and How This Was Checked This article is based on the official pages below, read on 23 October 2026. The 23 October ACSC alert was compared with Fortinet’s 21 October release notice and version tables. No Fortinet device, upgrade or mitigation was tested. The practical recommendations are editorial guidance. No hands-on test was performed. ### Official Pages Used - [ASD’s ACSC: Critical vulnerabilities in Fortinet products](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-fortinet-products): Affected families, automatic versus manual cloud updates, Australian exploitation caveat and mitigation advice. - [Fortinet: Security hardening release for multiple products](https://www.fortinet.com/blog/ciso-collective/fortinet-releases-security-hardening-release-for-multiple-products): Affected and fixed version tables, October release schedule, November advisory timing, configuration backup and monitoring.