The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has issued a critical alert urging organisations using Fortinet products to apply security updates, after Fortinet disclosed critical vulnerabilities affecting a range of its platforms.
In an alert dated 23 October 2026, the ACSC said Fortinet is releasing security updates for “a wide range of products” and has advised customers to prioritise patching. The alert is intended for all organisations using Fortinet products.
The ACSC said it is monitoring the situation but has no additional details beyond Fortinet’s public guidance. Fortinet is expected to release more information on 10 November 2026, according to the ACSC.
Fortinet has indicated that multiple versions of FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator are affected. The ACSC directed organisations to Fortinet’s list of affected products and fixed versions.
According to the ACSC, affected versions of FortiSASE have already had updates applied automatically, but FortiManager products may require manual updates.
The ACSC said it is not currently aware of active exploitation related to the vulnerabilities in Australia.
As mitigation, the ACSC advised organisations to identify Fortinet products in their environments, apply available security updates, monitor Fortinet guidance, and watch for signs of exploitation activity.
Where patches cannot be applied immediately, the ACSC cited Fortinet’s recommendations to reduce exposure by restricting administrative interfaces such as HTTPS and SSH to trusted IP addresses (or disabling them on external interfaces), ensuring FortiManager administration is not reachable from the internet, and using strong credentials with multi-factor authentication on user accounts.
Organisations that have been impacted, suspect impact, or require assistance can contact the ACSC via 1300 CYBER1 (1300 292 371) or submit a report through cyber.gov.au.
