[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDw5P-EhfHZoALGOC1YOZDAhJ87RVPSscqAD3uREWkng":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":127},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"aa68e0f2-b87a-48ad-80bd-a438274616e7","Fortinet patches critical FortiOS flaws found with AI help","fortinet-patches-critical-fortios-flaws-found-with-ai-help-307213","Fortinet rolled out security hardening updates for FortiOS, FortiManager, FortiAnalyzer, FortiMail, and FortiAuthenticator last week, but is keeping the details about the fixed vulnerabilities under wraps until November 10, 2026. The vulnerabilities were uncovered with the help of AI models and validated by humans, Fortinet’s Chief Information Security Officer Carl Windsor explained in the advance announcement. But attackers also have access to AI tools, he warned, and can use them to find vulnerabilities and build … More → The post Fortinet patches critical FortiOS flaws found with AI help appeared first on Help Net Security.","Fortinet has released security updates for multiple products, including FortiOS, addressing critical and high-severity vulnerabilities discovered with the assistance of AI models. The company is withholding specific details about these flaws until November 10, 2026, citing concerns that attackers, also leveraging AI, could exploit the narrow window between disclosure and patching. Administrators are strongly advised to upgrade immediately, especially for internet-facing systems, as AI can potentially link lower-severity vulnerabilities to create more severe exploits.","Fortinet patches critical FortiOS flaws found with AI help, details withheld until Nov 2026.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F26\u002Ffortinet-patches-critical-fortios-flaws-found-with-ai-help\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F01\u002F21163736\u002Ffortinet-man-1500.webp","2026-10-26T11:22:52+00:00","2026-10-26T12:00:16.288873+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Fortinet","vendor",{"name":21,"type":22},"FortiOS","product",{"name":24,"type":22},"FortiManager",{"name":26,"type":22},"FortiAnalyzer",{"name":28,"type":22},"FortiMail",{"name":30,"type":22},"FortiAuthenticator","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,24],{"controls":52,"vendors":121},[53,82,107],{"slug":54,"name":55,"problem":56,"products":57},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":83,"name":84,"problem":85,"products":86},"patch-management","Automated patch management","Known holes get closed in days, not months.",[87,91,99],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":83,"product_name":88,"url":89,"description":90},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":108,"name":109,"problem":110,"products":111},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[112,113],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[122],{"slug":123,"name":18,"logo_path":124,"roles":125},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[126],"affected",{"slug":128,"title":129,"body":130,"framework_refs":131,"framework_notes":139},"fortinet-patches-critical-fortios-flaws-discovered-with-ai-assistance","Fortinet Patches Critical FortiOS Flaws Discovered with AI Assistance","Fortinet identified and patched critical vulnerabilities in FortiOS using AI-assisted security research, but the disclosure highlights a growing challenge: AI tools can be used both to discover flaws and to exploit them before patches are widely applied. The decision to withhold technical details until 2026 reflects the reality that the window between disclosure and patching is dangerously narrow for internet-facing systems. Particularly concerning is the AI-enabled ability to chain lower-severity vulnerabilities into high-impact exploits, raising the stakes for organizations that delay upgrades. This incident underscores that organizations running network perimeter devices must treat critical vendor patches as emergency-priority items, not routine maintenance.",[132,133,134,135,136,137,138],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":140,"PCI DSS Requirement 6":141,"NIST SP 800-53 SI-2: Flaw Remediation":142,"CIS Control 17: Incident Response Management":143,"OWASP A06:2021 Vulnerable and Outdated Components":144,"CIS Control 7: Continuous Vulnerability Management":145,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":146},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures; the AI-accelerated threat landscape described in this incident reinforces why NIS2's mandated patching and risk management obligations must be operationalized urgently.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches in a timely manner; organizations using FortiOS to protect cardholder data environments must treat these critical patches as mandatory and time-bound.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; a formal flaw remediation process would enforce the emergency patching timeline Fortinet's advisory demands for internet-facing systems.","Having a tested incident response plan ensures that when AI-assisted exploitation attempts occur during the disclosure-to-patch window, the organization can detect, contain, and recover quickly rather than suffering extended compromise.","This risk category addresses the danger of running software with known vulnerabilities; FortiOS devices left unpatched after a critical advisory fall squarely into this category, making them prime targets for AI-assisted chained exploits.","This control mandates continuous scanning and timely remediation of vulnerabilities; applying it would ensure FortiOS devices are identified as unpatched and prioritized for immediate upgrade before attackers can leverage AI-assisted exploitation.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action; it directly applies here as organizations must evaluate and apply Fortinet's patches within the narrow pre-disclosure window."]