FortiOS 7.0 End of Life: Support Ended Sept. 30, 2025, and 26 Fortinet Advisories Since Offer No 7.0 Fix

FortiOS 7.0 end of life came on September 30, 2025, Fortinet’s End of Support date for the branch, after engineering support ended March 30, 2024. The last build is 7.0.19, published January 30, 2026; 7.0.17 was not the final one. As of Nov 13, 2026, 26 FortiGuard advisories issued since end of support tell 7.0 users to migrate, with no 7.0 fix.

Key findings

1. FortiOS 7.0 reached End of Support on September 30, 2025, 409 days before Nov 13, 2026; engineering support had ended March 30, 2024 (Fortinet KB).
2. 7.0.17 was not the last build: Fortinet shipped 7.0.18 on Nov 6, 2025, 296 days after 7.0.17 and five weeks after end of support, then 7.0.19 on Jan 30, 2026. None since.
3. Since end of support, 39 FortiGuard advisories (42 CVEs) list FortiOS 7.0 builds as affected. 26 of them tell 7.0 users to ‘migrate to a fixed release’; 3 leave 7.0 out of the web table although the machine-readable CVRF file marks 7.0 affected.
4. Of the 17 advisories affecting 7.0 published after 7.0.19, only 1 names a 7.0 fix, and that fix (7.0.18) predates the advisory.
5. 2 critical flaws (CVSS 9.3 and 9.0, both November 10, 2026) affect every 7.0 build through 7.0.19 with no 7.0 fix.
6. 9 of the 21 Fortinet entries CISA added to its exploited-vulnerabilities catalog since January 2024 affect FortiOS 7.0; 5 were added after end of support, and 2 of those have no 7.0 fix.
7. 2 FortiGate models (1200D, 3800D) cannot run any newer branch; 5 more top out at 7.2 and 17 at 7.4, out of 135 hardware models that 7.0.19 supports.

Free to cite and republish with a link. The full advisory dataset is in the CSV below.

Is FortiOS 7.0 still supported?

No. In a knowledge-base article dated September 18, 2025, a Fortinet staff editor wrote that “v7.0 has passed its End of Engineering Support date (EoES) of 2024-03-30” and was approaching “End of Support (EoS) as of 2025-09-30”, and that “there will not be extended support for regular v7.0 GA firmware.” Fortinet’s March 2026 lifecycle note adds the rule that applies at the TAC desk: to receive support, a device must run a branch that has not reached its End of Support date.

Unlike 6.4, 7.2 and 7.6, FortiOS 7.0 is not a Long Term Support branch. Fortinet’s LTS article names only those three, so a FortiCare Elite contract does not buy extra 7.0 updates. The one carve-out is the FIPS-CC certified 7.0 specialty firmware (FIPS-CC-70-6 and CVE-patched builds such as FIPS-CC-70-21): Fortinet promised high and critical CVE patches for at least 12 months after end of support, to September 2026, and has told those users to move to the 7.2 FIPS-CC build certified on January 19, 2026.

Is 7.0.17 the last FortiOS 7.0 build?

No. Fortinet’s Document Library lists 20 FortiOS 7.0 releases, 7.0.0 through 7.0.19. After 7.0.17 (January 14, 2025) the branch went quiet for 296 days, then 7.0.18 (build 0695) appeared on Nov 6, 2025 and 7.0.19 (build 0696) on Jan 30, 2026, both after end of support. Those two builds line up with two critical FortiCloud SSO login bypasses that CISA lists as exploited: FG-IR-25-647 (CVE-2025-59718, fixed in 7.0.18) and FG-IR-26-060 (CVE-2026-24858, fixed in 7.0.19). No 7.0 build has been published in the 287 days since.

Dots: each 7.0.x build, placed at the date its release notes were first published (“Initial release” in the change log). Blue: engineering support; navy: must-fix phase; red: after end of support.

What Fortinet offered 7.0 after end of support

We read every FortiGuard advisory whose CVRF file marks a FortiOS 7.0 build as “Known Affected” (96 advisories, 106 CVEs, mostly 2024 to 2026) and parsed the version table on each advisory’s web page. Before engineering support ended, 9 of the 10 advisories named a 7.0 upgrade and none said migrate. In the 18-month must-fix window, 22 of 47 already said “migrate to a fixed release.” After September 30, 2025 the mix flipped: 26 of 39 say migrate, 10 name a 7.0 build, and 3 omit 7.0 from the web table entirely even though the CVRF lists 7.0.0 to 7.0.19 as affected. The broader picture of Fortinet vulnerabilities in 2026 covers every product line; this ledger keeps only what touches 7.0.

Advisories by first-publication quarter. 2026 Q4 runs to Nov 13, 2026. 4 advisories first published in 2023 that carry 2024 CVE records are in the CSV but not the chart.

Severity did not decide which flaws got a 7.0 fix. 7 of the 26 “migrate” advisories carry a Fortinet CVSS score of 7.0 or more, including FG-IR-26-267 (authentication bypass, 9.3) and FG-IR-26-273 (unauthenticated adjacent command execution via HA, 9.0), both published November 10, 2026. 6 of the 39 post-EoS advisories are SSL-VPN flaws by title; our vendor scorecard of exploited VPN vulnerabilities shows how often VPN gateway CVEs end up in CISA’s catalog.

Exploited flaws that hit FortiOS 7.0

CISA added 21 Fortinet CVEs to its Known Exploited Vulnerabilities catalog between January 1, 2024 and catalog version 2026.11.10; 9 of them sit in advisories that list FortiOS 7.0 as affected. 3 carry CISA’s “known ransomware use” flag. 5 were added after 7.0 end of support, and for 2 of those, CVE-2025-68686 (SSL-VPN symlink persistence patch bypass) and CVE-2025-61624 (CLI path traversal), Fortinet’s only remedy for 7.0 is migration. The same catalog’s additions across all vendors are broken down in our analysis of the CISA KEV catalog in 2026.

Fortinet 7.0 end of life vs 7.2, 7.4, 7.6 and 8.0

Fortinet’s policy gives each FortiOS branch 36 months of engineering support from GA, then 18 months of “must fix” support, then End of Support. 7.0 followed that rule to the day (GA March 30, 2021). In March 2026 Fortinet added a year to both 7.4 and 7.6 (Customer Support Bulletin CSB-260330-1).

GA dates are the first “Initial release” date in each branch’s x.0 release-note change log. 6.4 and 7.2 got builds after their standard end of support (6.4.16 on Mar 27, 2025, 7.2.14 on Oct 22, 2026) because they are LTS branches for FortiCare Elite customers. 8.0 dates follow the standard policy and are not yet confirmed by a Fortinet article we could fetch.

Which FortiGate models can move past 7.0

We compared the 135 hardware models in the FortiOS 7.0.19 release notes (main and special branches, VMs excluded) with the supported-model lists in 7.2.14, 7.4.13, 7.6.8 and 8.0.2. 105 can run 8.0. 2 cannot leave 7.0, and Fortinet’s own recommended-release table, which uses “the latest FortiOS the device can support” for older products, agrees: it lists 7.0.19 for the FortiGate-1200D and 3800D and 7.2.14 for the 100E, 101E, 1500D and 1500DT.

Models whose newest branch is 8.0 (105) are omitted from this table but are in the checker. A model listed in a branch’s current release notes can run that branch; hardware support dates (End of Order, EOS) are separate and sit in Fortinet’s login-gated portal.

What this means for MSPs

• Pull firmware versions now. Any client FortiGate reporting 7.0.x is on a branch that has had 26 “migrate” advisories since September 30, 2025, including two rated critical on November 10, 2026.
• 7.0.19 is the floor, not a finish line. If a unit must stay on 7.0 for a few weeks, 7.0.19 is the only build with the FortiCloud SSO fixes for CVE-2025-59718 and CVE-2026-24858. It still carries the 13 migrate-only advisories published after it.
• Sort the fleet by hardware ceiling. FortiGate-1200D and 3800D units need replacement, not an upgrade. 100E, 101E, 100EF, 1500D and 1500DT units can reach 7.2.14, which passed standard end of support on September 30, 2026, so they belong in the same refresh budget.
• Check SSL-VPN before jumping to 7.6. Fortinet’s 7.6.3 release notes say SSL VPN tunnel mode is replaced with IPsec VPN on all FortiGate models and its settings are not carried over, so clients moving from 7.0 to 7.6 need a VPN migration first. For E-series desktops such as the 60E and 80E, Fortinet’s recommended release is 7.4.13.
• FIPS clients are a separate track. Fortinet promised FIPS-CC 7.0 CVE patches for at least 12 months after end of support, to September 2026; Fortinet now points those users to the 7.2 FIPS-CC build certified January 19, 2026.

FAQ

Is FortiOS 7.0 still supported?

No. Fortinet’s knowledge base gives FortiOS 7.0 an End of Engineering Support date of March 30, 2024 and an End of Support date of September 30, 2025, and says there is no extended support for regular 7.0 GA firmware. As of Nov 13, 2026 that end of support was 409 days ago. The only exception is the FIPS-CC certified 7.0 branch, which Fortinet said would get high and critical CVE patches until at least September 2026.

Is FortiOS 7.0.17 the last 7.0 build?

No. Fortinet’s release notes list two later builds: 7.0.18 (build 0695, first published Nov 6, 2025) and 7.0.19 (build 0696, Jan 30, 2026). Both came after end of support and both fixed critical FortiCloud SSO bypasses that CISA lists as exploited. No 7.0 build has appeared in the 287 days since 7.0.19.

What is the difference between end of life and end of support?

Fortinet does not use a single ‘end of life’ date for firmware. End of Engineering Support comes 36 months after GA; after that only ‘must fix’ issues get patched for 18 more months. End of Support is the final date, after which Fortinet is ‘under no obligation to provide support services.’ For FortiOS 7.0 those dates were March 30, 2024 and September 30, 2025.

When does FortiOS 7.4.7 reach end of life?

Fortinet dates the 7.4 branch, not single builds: End of Engineering Support May 11, 2027 and End of Support November 11, 2028, after a one-year extension announced in March 2026. Fortinet supports only the latest patch of a branch, so a 7.4.7 unit should move to 7.4.13 (released Oct 22, 2026).

Is FortiOS 7.2 still supported?

Under Fortinet’s standard 36 plus 18 month policy, 7.2 (GA March 31, 2022) reached end of support on September 30, 2026. 7.2 is a Long Term Support branch, so FortiCare Elite customers get an extended end of support, and Fortinet published 7.2.14 on Oct 22, 2026. Other customers should plan on 7.4 or later.

Which FortiGate models cannot upgrade past FortiOS 7.0?

Two of the 135 hardware models in the 7.0.19 release notes, the FortiGate-1200D and FortiGate-3800D, appear in no newer branch’s current release notes, and Fortinet’s October 2026 recommended-release table lists 7.0.19 for both. Five more (100E, 100EF, 101E, 1500D, 1500DT) stop at 7.2, which is also past standard end of support.

Methodology

References

1. Fortinet Community KB: Technical Tip: Extended support for v7.0 FIPS-CC Certified/CVE-Patched firmware (Sep 18, 2025, updated Aug 3, 2026). Accessed November 2026.
2. Fortinet Community KB: Customer Service Tip: Product Life Cycle Information on Fortinet products (updated Aug 10, 2026). Accessed November 2026.
3. Fortinet Community KB: Technical Tip: FortiOS End of Support change for FortiOS v7.4 and v7.6 (Mar 5, 2026). Accessed November 2026.
4. Fortinet Community KB: Technical Tip: Long Term Support and Extended End of Support on FortiOS v6.4, v7.2 and v7.6 (updated Apr 16, 2026). Accessed November 2026.
5. Fortinet Community KB: Recommended release for FortiOS (as of October 2026, updated Oct 27, 2026). Accessed November 2026.
6. Fortinet Community KB: Customer Service Tip: How to check the FortiOS lifecycle. Accessed November 2026.
7. Fortinet Support: Product Life Cycle (portal; not machine-read for this report). Accessed November 2026.
8. Fortinet Document Library: FortiGate / FortiOS 7.0 release notes, 7.0.0 to 7.0.19 (Introduction and supported models, Change log). Accessed November 2026.
9. Fortinet: FortiOS 7.0.19 release notes, Introduction and supported models. Accessed November 2026.
10. Fortinet: FortiOS 7.2.14 release notes. Accessed November 2026.
11. Fortinet: FortiOS 7.4.13 release notes. Accessed November 2026.
12. Fortinet: FortiOS 7.6.8 release notes. Accessed November 2026.
13. Fortinet: FortiOS 8.0.2 release notes. Accessed November 2026.
14. Fortinet: FortiOS 7.6.3 release notes, SSL VPN tunnel mode replaced with IPsec VPN. Accessed November 2026.
15. FortiGuard Labs PSIRT advisories and CVRF files (96 advisories that list FortiOS 7.0 as affected). Accessed November 2026.
16. NIST National Vulnerability Database, CVE API 2.0 (Fortinet CNA records, Jan 2024 to Nov 2026). Accessed November 2026.
17. CISA Known Exploited Vulnerabilities catalog, JSON feed, version 2026.11.10. Accessed November 2026.
18. endoflife.date: FortiOS (cross-check of branch dates). Accessed November 2026.