Fortinet Security Updates: What Australian Businesses Should Check

Australian businesses using Fortinet products should check their update status after ASD’s Australian Cyber Security Centre issued a critical alert on 23 October. The alert covers several product families and urges organisations to apply available security updates, identify affected systems and continue monitoring for signs of exploitation.

Which Products Are Covered

The ACSC names FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Fortinet’s release notice provides affected-version and fixed-version tables for each family. Match the exact product and software branch to that table rather than assuming one upgrade number applies to everything.

For FortiOS, Fortinet lists fixes in 8.0.2, 7.6.8, 7.4.13 and 7.2.14, or later releases in the relevant branches. That is a reference for the affected FortiOS branches, not a universal upgrade instruction for other products. The appropriate path for an individual appliance should be confirmed by its administrator.

If your supplier manages the equipment, request an inventory that links each affected service to its product name, installed release and proposed fixed release. Our recommendation is to use that record to track completion. A statement that the network has been checked is less useful than confirmation identifying what was checked and what changed.

Cloud Services Need Separate Answers

The ACSC says affected FortiSASE versions have received updates automatically, while FortiManager products may need manual updates. Fortinet specifically says FortiManager Cloud releases may require a manual update, and public-cloud instances follow the relevant cloud partners’ release processes.

The practical question is therefore who owns each update. A business might have one team managing connectivity and another looking after the management platform. Assign a person to gather the responses and follow up any missing confirmation, rather than assuming an update to one part of the service covers the rest.

What to Do While Updates Are Arranged

Fortinet recommends backing up configurations before upgrading and reviewing logs for unusual administrative access or unauthorised configuration changes. If patching cannot happen immediately, its interim advice includes restricting administrative access to trusted IP addresses, keeping FortiManager administration off the public internet, and using strong credentials with multifactor authentication.

These are administrator tasks that need to fit the existing environment. Forward the official notice and ask the responsible team to document the temporary measures it chooses. Fortinet is explicit that reducing exposure does not replace a timely upgrade; a mitigation should have an owner and a follow-up patching plan.

The ACSC says it is not aware of related active exploitation in Australia. That statement describes the agency’s awareness at the time of the alert, not proof that an individual system is unaffected. The agency also says further public detail is expected on 10 November, so waiting for fuller technical disclosure is not the recommended update strategy.

For a small business, the immediate job is coordination: identify the person responsible, obtain the inventory and ask for a clear completion report. If an update is delayed, record the reason and the next decision point. That gives the owner something concrete to follow up without attempting unfamiliar network changes personally.

Sources and How This Was Checked

This article is based on the official pages below, read on 23 October 2026. The 23 October ACSC alert was compared with Fortinet’s 21 October release notice and version tables. No Fortinet device, upgrade or mitigation was tested. The practical recommendations are editorial guidance. No hands-on test was performed.