Source: CERT-In advisory CIAD-2026-0054 • Date: 24 October 2026 (updated 26 October 2026)
The CERT-In Fortinet advisory (CIAD-2026-0054), issued on 24 October 2026, warns of critical and high-severity flaws in FortiOS, FortiManager, FortiMail, FortiAuthenticator and FortiAnalyzer, and asks organisations to patch as an emergency change.
CERT-In Fortinet advisory: key facts
- CERT-In issued advisory CIAD-2026-0054 on 24 October 2026 and updated it on 26 October 2026.
- Fortinet describes the flaws as critical and high-severity, according to CERT-In.
- Affected products: FortiOS, FortiManager, FortiMail, FortiAuthenticator and FortiAnalyzer.
- CERT-In says the fixes should be handled as a priority emergency change, not routine maintenance.
- No CVE IDs are listed yet. Fortinet PSIRT is due to publish CVE identifiers and CVSS scores on 10 November 2026.
- Fortinet says the flaws were found through AI-assisted security testing.
What CERT-In asks organisations to do
- List all Fortinet assets, starting with internet-facing FortiOS devices and FortiManager controllers.
- Take a full configuration backup of each device before upgrading.
- Apply the fixed versions during an emergency maintenance window.
- If you cannot patch yet, limit HTTPS and SSH management access to trusted IP addresses and disable them on external interfaces.
- Keep FortiManager reachable only from internal networks and require MFA for all administrator accounts.
- Place critical resources behind a VPN or SASE solution.
Why CERT-In wants speed
- CERT-In warns that the gap between a patch release and active exploitation is shrinking.
- Attackers may use AI to reverse-engineer patches and chain low-severity flaws into severe exploits.
- Internet-facing systems should be patched first.
What to check
- Fixed version numbers: the advisory text we could read did not list them, so confirm them on Fortinet’s PSIRT page.
- The advisory does not describe the individual flaws or say whether they are being exploited.
CERT-In Fortinet advisory FAQ
What is the CERT-In Fortinet advisory?
CIAD-2026-0054 warns of critical and high-severity flaws in five Fortinet products and asks organisations to patch as an emergency change.
Which Fortinet products are affected?
FortiOS, FortiManager, FortiMail, FortiAuthenticator and FortiAnalyzer.
What if I cannot patch straight away?
CERT-In suggests limiting management access to trusted IPs, keeping FortiManager internal, requiring MFA for admins and placing critical resources behind a VPN or SASE.
Related: PHP2Shell: CERT-In Urges Indian Sites to Patch PHP Now
Last updated: 26 October 2026
