Skip to content
Patcharo

Guides

Choosing a FortiOS release: recommended, fixed, supported, and the upgrade path to it

A method to choose the FortiOS release to install on a FortiGate: the recommended release for the model, the first fixed release of your advisories, the branch's life cycle, the supported models, FortiManager and FortiAnalyzer, and the path the Upgrade Path Tool gives.

Who it is for
Engineers who plan FortiGate firmware upgrades and the people who approve them.
Scope
FortiOS on FortiGate, with FortiManager and FortiAnalyzer as the management and logging constraints. Other Fortinet products follow the same method with their own documents.

Published 19 Oct 2026 · Updated 19 Oct 2026 · Sources checked 19 Oct 2026

Start from the appliance

Write down the model of the appliance (the exact model, with its variant), the release it reports, whether it is part of an HA cluster or a Security Fabric, the FortiManager and FortiAnalyzer that manage and log it with their releases, and the advisories that concern it with the fixed release each states for your branch. The decision is taken against these facts.

Three candidates and what each one is

CandidateThe question it answersWhere it comes from
The recommended release for the modelWhich release does Fortinet advise for this appliance?Fortinet's technical tip, per model; Patcharo shows it per model with its date.
The newest release of the branchWhich release of my branch exists and carries the most fixes?The Document Library; Patcharo's catalog lists it with its release date.
The first fixed release of your advisoriesWhich release closes the vulnerabilities that concern this appliance?The FortiGuard advisories, per branch.
A target satisfies the third question, respects the first, and is tested against the constraints below.

A Mature label or a recommendation does not make a release safe for your advisories. When the recommended release for your model is older than the first fixed release an advisory states, the appliance stays affected on the recommended release: install the fixed release, or a later one the vendor supports for your model, and record why.

The constraints that decide

  1. Supported models: each release's notes list the models it supports; a release that does not list your model is not a candidate. The Product Life Cycle also gives the last supported software of older models.
  2. Branch life cycle: a branch past its end of engineering support receives no regular fixes; a target in such a branch is a dead end for the next advisory.
  3. Upgrade path: the Fortinet Upgrade Path Tool gives the supported path from your release to the target; some paths go through intermediate releases, each a reboot. A path the tool does not give is not supported.
  4. FortiManager and FortiAnalyzer: their compatibility with the FortiOS release is stated in their own documentation; a target FortiOS release newer than what your FortiManager supports means upgrading the management first.
  5. Special notices and upgrade information: each release's notes carry them; a target that changes a default, a certificate requirement or a feature you rely on needs a configuration review.
  6. HA and Security Fabric: the release notes describe the upgrade order of cluster members and of Fabric devices; a release every member and every Fabric root supports is required.

A method in six steps

  1. List the advisories that concern the appliance and the fixed release each states for your branch; the newest is the floor.
  2. Read the recommended release for your model; prefer it when it is at or above the floor and still supports your model, otherwise take the floor or the next release the vendor supports.
  3. Check the branch's life cycle: if the branch is near its end of engineering support, make the target a release of a later branch and move the floor there.
  4. Read the target's release notes: supported models, special notices, upgrade information, known issues.
  5. Get the upgrade path from the Upgrade Path Tool and the FortiManager and FortiAnalyzer requirements; schedule the intermediate releases and the management upgrades first.
  6. After the upgrade, record the release the appliance reports and let the matching run again.

The current FortiOS releases and recommendations, as the catalog reads them

Below, the branches still supported with the newest release each lists and the vendor's recommendation when one is stated, as Patcharo last read them from the Document Library and from Fortinet's technical tip.

Current versions, from the catalog

Read from the vendor's own documents by the collection described in this guide; the examples in the text are illustrative and dated, these facts are live.

FortiOS

Product page
  • 8.0Latest public release —Vendor recommendation —Not collected
  • 7.6Latest public release —Vendor recommendation 7.6.6Not collected
  • 7.4Latest public release —Vendor recommendation 7.4.11Not collected

FortiManager

Product page
  • 8.0Latest public release —Vendor recommendation —Not collected
  • 7.6Latest public release —Vendor recommendation —Not collected
  • 7.4Latest public release —Vendor recommendation —Not collected

FortiAnalyzer

Product page
  • 8.0Latest public release —Vendor recommendation —Not collected
  • 7.6Latest public release —Vendor recommendation —Not collected
  • 7.4Latest public release —Vendor recommendation —Not collected

Availability, recommendation and support are read from the vendor's documents and shown apart; a release Patcharo lists is not advice to install it.

Frequent mistakes

  • Installing the recommended release on an appliance for which an advisory states a later fixed release.
  • Upgrading along a path the Upgrade Path Tool does not give.
  • Upgrading FortiGate before checking what the FortiManager and FortiAnalyzer releases support.
  • Choosing a release whose notes do not list the appliance's model.

What to verify before acting

  • The floor: the newest fixed release among the advisories that concern the appliance, in its branch.
  • The recommended release for the exact model and its date.
  • The target's supported models, special notices and known issues in its release notes.
  • The upgrade path from the Upgrade Path Tool and the FortiManager and FortiAnalyzer compatibility.
  • The branch's dates in the Product Life Cycle.

Sources

The official documents this guide rests on, read against the text on 19 Oct 2026. Nothing here is copied from them: read them for the authoritative wording.