Technical Tip: Explanation of 'Branches to fix' version in Fortinet PSIRT Policy

[kcheng]

Description	This article explains the definition of 'Branches to fix' corresponding to the CVSS score.
Scope	All FortiOS.
Solution	Fortinet PSIRT policy defines the 'Branches to fix' based on the CVSS score assigned to a specific vulnerability. The full PSIRT policy can be found via the following link: PSIRT Policy  In the PSIRT policy, the branches to fix are highly dependent on the severity of the reported vulnerability: As of February 2025, the FortiOS that is still in engineering support is as follows: FortiOS End of Engineering Date 7.2 2025-03-31 7.4 2026-05-11 7.6 2027-07-25 Reference: Fortinet Product Life Cycle Based on the information above, the categorization of the 'Branches to fix' is as follows: Branches to fix Definition FortiOS Version (as of February 2025) All supported versions. All supported FortiOS versions are currently still under Engineering support. v7.2, v7.4, v7.6. Current and prior versions. The latest major version (n) and prior major versions (n-1) among all FortiOS versions are currently under Engineering Support. v7.4, v7.6. Fixed in the latest supported version. The latest major version among all FortiOS versions that are currently under Engineering Support. v7.6. Fixed in the next major version. Future major version. >v7.6.