The advisory, published on Friday, carries INCIBE-CERT's top (critical) rating. Fortinet has fixed several critical and high-severity flaws in FortiOS (branches 7.2 to 8.0), FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Technical details and CVE identifiers won't be released until 10 November, so for now it isn't known exactly what they allow an attacker to do.
Fixed versions include FortiOS 8.0.2, 7.6.8, 7.4.13 and 7.2.14. Watch out for FortiMail 7.2: there is no patch and you need to move to a supported branch.
What to do: back up your configuration before updating, start with internet-facing devices, restrict admin access to trusted IPs with two-factor authentication, and don't leave FortiManager exposed. Many small businesses in the Canaries use this brand of firewall, so it's worth checking first thing on Monday.
Sources
This is our own summary. The full story is in the linked outlets, which publish in Spanish.
