Security News

ACSC Urges Australian Organisations to Patch Fortinet Products Now

Australian Cyber Security Magazine · 26 Oct 2026

Key Takeaway Check now whether your business or IT provider uses any Fortinet products, then apply the fixed versions listed by Fortinet and make sure administration pages are not exposed to the internet.

The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) has issued a critical alert for organisations using Fortinet products. In its alert dated 23 October 2026, the ACSC said Fortinet is releasing security updates for "a wide range of products" and has advised customers to prioritise patching. Multiple versions of FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator are affected. FortiSASE has already been updated automatically, but FortiManager products may need manual updates.

The ACSC said it is not currently aware of active exploitation of these vulnerabilities in Australia. It is monitoring the situation and has no further details beyond Fortinet's public guidance, with more information expected from Fortinet on 10 November 2026. Organisations should identify the Fortinet products in their environment, apply available updates, follow Fortinet's guidance and watch for signs of exploitation.

Where patching cannot happen straight away, the ACSC pointed to Fortinet's advice for reducing exposure. This includes limiting administrative interfaces such as HTTPS and SSH to trusted IP addresses, or disabling them on external interfaces. FortiManager administration should not be reachable from the internet, and user accounts should use strong credentials with multi-factor authentication. Affected or concerned organisations can call 1300 CYBER1 (1300 292 371) or report through cyber.gov.au.

Summarised by CISO AI from Australian Cyber Security Magazine, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.