On 10 November 2026 Fortinet published 15 security advisories covering its FortiGate firewalls (FortiOS), FortiManager, FortiAnalyzer and FortiSASE, several of them rated Critical. If your Perth business has a FortiGate, the job is simple: confirm it's running FortiOS 7.2.14, 7.4.13, 7.6.8, 8.0.2 or later, and if it's still on FortiOS 7.0, plan a move off it, because Fortinet hasn't listed a fixed 7.0 release. None of these flaws is known to be exploited yet. The reason to act now is that the full technical details are public, and that changes the clock.
What Fortinet actually announced
This one arrived in two stages. On 23 October the Australian Cyber Security Centre (ACSC) issued an alert urging every organisation using Fortinet products to prioritise patching. Fortinet was shipping updates across a wide range of products and had said more information would follow on 10 November.
That information is now out. Fortinet's security portal lists 15 advisories dated 10 November. The ones that matter most to a small or medium business are:
- CVE-2026-126253 (FortiOS, Critical, CVSS 9.3). An authentication flaw in the firewall's OSPF routing feature. An attacker with no login, sitting on a network the firewall is connected to, could inject false routing information.
- CVE-2026-126254 (FortiOS, Critical, CVSS 9.6). A bug in the BGP routing feature that could let a configured routing neighbour crash connected routers.
- CVE-2026-121530 (FortiOS 7.6.0 to 7.6.6, Medium). A two-factor authentication weakness that only affects administrator accounts which log in through a RADIUS server.
- Several Critical and High flaws in FortiManager and FortiAnalyzer, the tools used to manage and log fleets of FortiGates.
Fortinet says it found the OSPF flaw itself, with its product security team using an AI model to hunt for bugs. Expect more announcements like this. The same tools that help vendors find flaws faster are available to attackers.
Does this actually affect a small office?
Here's the honest answer. The two headline FortiOS flaws are in OSPF and BGP, dynamic routing features that larger and multi-site networks use. A typical single-office FortiGate sitting between the NBN connection and the office network often doesn't have either switched on. The OSPF flaw also needs the attacker to be on a network the firewall is connected to, not just anywhere on the internet.
So for many Perth small businesses the real-world risk from those two bugs is lower than the "Critical" label suggests. That's not a reason to skip the update, for three reasons:
- You may not know what's switched on. Firewalls get set up once, often by someone who has since moved on. Multi-site businesses joined by VPN are exactly the ones likely to be running dynamic routing.
- The same firmware fixes everything at once. You don't pick and choose flaws. Updating to the current release closes this month's issues along with anything else fixed since your last update.
- The details are now public. Fixes were going out weeks before Fortinet explained them. Now anyone can compare the old and new firmware and see what was fixed. Firewalls that are still unpatched are the obvious targets.
What to check this week
1. Find out which FortiOS version you're running
Log in to the FortiGate's admin page. The version is shown on the dashboard, or under System > Firmware & Registration. If someone else manages your firewall, ask them to confirm the version in writing.
You're covered for this month's FortiOS advisories if you're on:
- FortiOS 8.0.2 or later
- FortiOS 7.6.8 or later
- FortiOS 7.4.13 or later
- FortiOS 7.2.14 or later
2. If you're on FortiOS 7.0, plan a migration
Fortinet's advisory for the OSPF flaw lists FortiOS 7.0.1 to 7.0.19 as affected, with the fix given as "migrate to a fixed release" rather than a 7.0 update. That means a jump to a newer major version, and on older hardware it can mean the box can't run a supported release at all. If your FortiGate is several years old, find this out now rather than in an emergency.
3. Upgrade properly, not just quickly
Fortinet recommends its online upgrade tool to work out the right path. Jumping too many versions in one go can break settings. Before upgrading:
- Back up the current configuration.
- Schedule it out of hours, because the firewall will restart and the internet will drop.
- Check your VPN, Wi-Fi and any remote access still work afterwards.
4. Lock down the admin page
The ACSC's interim advice, which is good practice regardless, is to restrict the firewall's admin interfaces (HTTPS and SSH) to trusted IP addresses or switch them off on internet-facing ports. Use strong passwords and multi-factor authentication on administrator accounts. If your FortiGate's login page can be reached from anywhere on the internet, fix that today.
5. Ask your IT provider about FortiManager
If an IT provider manages your firewall, they may be using FortiManager to do it, and several of this month's Critical flaws are in FortiManager and FortiAnalyzer. That's their system to patch, not yours, but it's a fair question: "Have you applied Fortinet's 10 November FortiManager fixes?" The ACSC specifically advises that FortiManager administration should never be reachable from the internet.
The bigger lesson: firewalls need patching too
Most businesses now accept that Windows PCs need monthly updates. We covered this month's Microsoft Patch Tuesday and its Outlook zero-day only a couple of days ago. Firewalls tend to get forgotten, because nobody logs into them day to day and they keep quietly working.
But the firewall is the front door. Over the past year firewalls and VPN gateways from many vendors have been among the first devices attackers go after, precisely because they face the internet and are patched less often. Our guide to firewall security management for Perth SMBs explains what ongoing care for a firewall should look like.
If you'd rather not track Fortinet advisories yourself, our managed firewall service covers firmware updates, configuration backups and admin lockdown as routine. We're Perth-based, we've been looking after local businesses since 1997, and if you're unsure what your FortiGate is running, call us on (08) 9325 1196 and we'll check it with you.