Recommended version on Fortigate

[philbud]

We always follow the Technical Tip: Recommended Release for FortiOS  link for the fortiOS version on our Fortigate. It's says for our Fortigate that the recommended FortiOS is 7.4.8 but this morning when i logged in on my fortigate I got a message saying Installed Firmware Contains Critical Vulnerabilities and that we should upgrade to 7.4.9.

So is the recommended version 7.4.8 or 7.4.9?

[brandonziots]

This is related to a known vulnerability specifically related to FortiCloud SSO admin login to FortiGate. As long as you have FortiCloud SSO login disabled in system settings you are fine to ignore the message.

[philbud]

As far as i know and someone can confirm or not that this is a firmware-level vulnerability, not only a configuration issue. Fortinet flags the device as vulnerable as long as it is running a FortiOS version affected by the vulnerability, regardless of whether FortiCloud SSO is currently enabled or disabled in the settings.

[brandonziots]

On our FortiGate running 7.2.8, we received the message with a link to this 9.1 CVE: https://www.fortiguard.com/psirt/FG-IR-25-647

However I do see an additional 7.4 CVE released just 3 days ago, which aligns better with when the message first showed up: https://www.fortiguard.com/psirt/FG-IR-25-084

The workaround on the 9.1 is to disabled FortiCloud SSO. The workaround on the second is to disable Security Fabric access on all of your interfaces. We have applied both work around but will be reaching out to TAC to clarify the banner message itself.

[deer]

I'm experiencing the same issue.
Even after selecting “Skip Upgrade & I understand the risk,” it reappears when I log in again.
Is there a way to remove this prompt?