Recommendation for Fortinet Devices: Upgrade to FortiOS 7.4.8

As part of UpKeep, our new feature to keep our NWG Manage customers' devices on the latest stable version, we reviewed the latest Fortinet releases and recommend an upgrade to FortiOS 7.4.8 for all supported devices. More details below.

Why Are You Sharing This Information?

Even if we're not managing Fortinet devices for you, we want you to have the latest information to help keep your devices secure.

• What should I do if I have a Fortinet device that NWG manages?
  If you have a Fortinet device(s) that we manage for you, we already know what hardware you have and what version you need to be on. We’ll handle the upgrade during an upcoming maintenance window. Zendesk notifications will be sent out once maintenance has been scheduled, including details about when implementation will take place. If your devices/locations require different days/times for maintenance to take place, you’ll receive separate tickets.
• What if I have a Fortinet device that NWG does not manage?
  If you have a Fortinet device(s) in your environment, we suggest you upgrade to the version listed below.
• What if I don't have any Fortinet devices?
  No action is needed if you don’t have any Fortinet devices or if your Fortinet devices are already running the recommended versions

Which Fortinet Release Do You Recommend?

Fortinet recommends FortiOS 7.4.8.

NWG recommends an upgrade to FortiOS 7.4.8:‍

• FortiOS 7.4.8 resolves 2 medium and 1 low vulnerabilities (CVE-2025-25250, CVE-2024-52963, and CVE-2025-24471). Release notes previously showed potentially severe issues, but these were identified under extreme load in lab testing and do not correlate to real-world environments.
• 7.4.9 has caused authentication outages with SAML configurations. Many new Hyperscale issues and limitations have also been identified
• In addition, Fortinet does not currently recommend any of the 7.6.X code train for use. While there are new features, the bugs identified create a much larger risk to production environments.

• If you have devices that are not capable of running 7.4, we recommend 7.2.11.
• If your devices are not capable of running 7.2 or 7.4, we recommend 6.2.16. Note that devices that cannot run firmware higher than 6.2 are in the end-of-life lifecycle and should be replaced.

Review Details

FortiOS 7.6

FortiOS 7.6 Review

Fortinet does not currently recommend any of the 7.6.X code train for use. While there are new features, the bugs identified create a much larger risk to production environments.

Bug ID: 965217
Description: In an HA configuration, FortiGate may experience intermittent heartbeat loss causing unexpected failover to the secondary unit.

Bug ID: 995912
Description: After a firmware upgrade, some VPN tunnels experience intermittent signal disruptions causing traffic to be re-routed.

FortiOS 7.6 Conclusion

NWG does not recommend using FortiOS 7.6.X on any Fortinet devices.

FortiOS 7.4

FortiOS 7.4.9 Review

This is the newest release of FortiOS. FortiOS 7.4.9 has a new feature that has caused authentication outages with SAML configurations. This change in default behavior verifies the signature for SAML response messages. This means that configurations must be made to the SAML IdP to sign SAML responses and assertions. While providers such as Azure can be reconfigured to work properly, the only workaround for other IdPs (such as Google) is to downgrade to FortiOS 7.4.8. 

On lower-end models (50G, 70G, 90G, and their variants), SSL VPN web and tunnel modes are no longer available, and any previous configuration will not be migrated during an upgrade. The workaround for this is to transition to IPSec for Remote Access VPN, but this requires planning due to changes required on the Firewall and to FortiClients.

In addition to the above SAML concerns, there are many new Hyperscale issues and limitations that have been identified. 

NWG does not recommend 7.4.9 at this time.

FortiOS 7.4.8 Review

Release notes for 7.4.8 previously showed some potentially severe issues. The new known issues in 7.4.8 are listed below. Version 7.4.8 resolves 2 medium and one low severity vulnerabilities (CVE-2025-25250, CVE-2024-52963, and CVE-2025-24471). NWG has not experienced the known issues listed below. The known issues were noticed under extreme load in lab testing and do not correlate to real-world environments. NWG recommends FortiOS 7.4.8 for all supported devices.

Bug ID: 1033083

Description: HA sessions are not properly synchronized, causing a high number of sessions on the primary unit, and the standby unit enters conserve mode.

Bug ID: 1101897

Description: VPN traffic sent bytes spike to anomalous levels within 10 minutes.

Bug ID: 1125487

Description: Autoconnect to IPsec VPN using Entra ID logon fails when there are multiple IPsec tunnels.

Bug ID: 1164811

Description: SSL VPN web mode showing Access Denied error after upgrade on 2GB models.

FortiOS 7.4.7 Review

FortiOS 7.4.7 does not show any severe, potentially service-impacting issues. It also resolves 1 critical and 1 medium vulnerability (CVE-2025-22252 and CVE-2025-22254).

FortiOS 7.4 Conclusion

NWG recommends FortiOS 7.4.8 for all supported devices.

FortiOS 7.2

FortiOS 7.2.12 Review

FortiOS 7.2.12 has a new feature that has caused authentication outages with SAML configurations. This change in default behavior verifies the signature for SAML response messages. This means that configurations must be made to the SAML IdP to sign SAML responses and assertions. While providers such as Azure can be reconfigured to work properly, the only workaround for other IdPs (such as Google) is to downgrade to FortiOS 7.2.11.

FortiOS 7.2.11 Review

Fortinet recommends version 7.2.11. There are no severe new issues identified in the 7.2.11 release over previous releases. Most new issues are either GUI issues or model-specific bugs that have workarounds. The only new features are more secure administrator password hashing and improved CPU performance when updating the IPS database. FortiOS 7.2.11 also resolves 1 high, 1 medium, and 1 low severity vulnerabilities (CVE-2024-52965, CVE-2025-22254, and CVE-2024-52963).

FortiOS 7.2 Conclusion

NWG recommends FortiOS 7.2.11 for all compatible devices that are not capable of running FortiOS 7.4.

FortiOS 6.2

FortiOS 6.2 Review

Fortinet recommends FortiOS 6.2.16. There are no new known issues with 6.2.16. There are also no new features. There are 1 critical and 3 high vulnerabilities resolved in 6.2.16 (CVE-2024-21762, CVE-2024-23110, CVE-2023-36639, and CVE-2023-41677).

FortiOS 6.2 Conclusion

NWG recommends FortiOS 6.2.16 for devices that are not capable of running 7.2 or 7.4. Note that devices that cannot run firmware higher than 6.2 are in the end-of-life lifecycle and should be replaced.

‍

Review Process

• Model Evaluation
  
  • Determines major code revision compatibility
• Vendor Recommended
  
  • https://community.fortinet.com/t5/FortiGate/Technical-Tip-Recommended-Release-for-FortiOS/ta-p/227178
• Newest Version (Mature/GA)
  
  • Evaluate known issues
  • Evaluate resolved issues
  • Evaluate features as needed
• Evaluate known vulnerabilities
  
  • https://www.fortiguard.com/psirt

Code Versions

• 7.4
  
  • 7.4.9
    
    • https://docs.fortinet.com/document/fortigate/7.4.9/fortios-release-notes/708555/special-notices
    • https://docs.fortinet.com/document/fortigate/7.4.9/fortios-release-notes/236526/known-issues
    • https://docs.fortinet.com/document/fortigate/7.4.9/fortios-release-notes/289806/resolved-issues
    • https://docs.fortinet.com/document/fortigate/7.4.9/fortios-release-notes/743723/new-features-or-enhancements
  • 7.4.8
    
    • https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/708555/special-notices
    • https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/236526/known-issues
    • https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/289806/resolved-issues
    • https://docs.fortinet.com/document/fortigate/7.4.8/fortios-release-notes/743723/new-features-or-enhancements
  • 7.4.7
    
    • https://docs.fortinet.com/document/fortigate/7.4.7/fortios-release-notes/236526/known-issues
    • https://docs.fortinet.com/document/fortigate/7.4.7/fortios-release-notes/289806/resolved-issues
    • No features
• 7.2
  
  • 7.2.12
    
    • https://docs.fortinet.com/document/fortigate/7.2.12/fortios-release-notes/708555/special-notices
    • https://docs.fortinet.com/document/fortigate/7.2.12/fortios-release-notes/236526/known-issues
    • https://docs.fortinet.com/document/fortigate/7.2.12/fortios-release-notes/289806/resolved-issues
  • 7.2.11
    
    • https://docs.fortinet.com/document/fortigate/7.2.11/fortios-release-notes/236526/known-issues
    • https://docs.fortinet.com/document/fortigate/7.2.11/fortios-release-notes/289806/resolved-issues
    • https://docs.fortinet.com/document/fortigate/7.2.11/fortios-release-notes/743723/new-features-or-enhancements
• 6.2
  
  • 6.2.16
    
    • https://docs.fortinet.com/document/fortigate/6.2.16/fortios-release-notes/236526/known-issues
    • https://docs.fortinet.com/document/fortigate/6.2.16/fortios-release-notes/289806/resolved-issues
    • No Features

‍