Fortinet Patch Policy: 4 Essential Options Before 5 December
By Claudia Sterling · 11 November 2026
Last updated: 11 November 2026
If your office firewall is a FortiGate managed through Fortinet’s free cloud service, the Fortinet patch policy now affects you. Firewalls without a paid cloud subscription must install each new firmware patch within 7 days of its release, or lose cloud access and log uploads. A new notice in Fortinet’s cloud portal says enforcement tightens from 5 December 2026. Here’s what that means and what your options are.
What is the Fortinet patch policy?
The Fortinet patch policy requires FortiGates that use FortiManagement Cloud (formerly FortiGate Cloud) without a Standard subscription to install the latest firmware patch within 7 days of release. Firewalls with a Standard subscription, and firewalls not managed through the cloud service, aren’t affected by this requirement.
The 7-day rule itself isn’t brand new. Fortinet’s support article says it has applied to log uploads since February 2025. What’s new is a notification in the FortiManagement Cloud portal, dated 4 November 2026. It says that from 5 December 2026, FortiGates without an active Standard subscription will have Fortinet’s firmware End of Support rules checked and enforced, and must also install new patches within 7 days to avoid “service restrictions”. In plain terms, a firewall on an out-of-support firmware version is now a problem too. Firmware upgrades and removing a firewall from the cloud service stay available, and nothing changes for firewalls with a Standard subscription. Fortinet hasn’t said exactly what the restrictions are.
What happens if you don’t patch in time?
Your firewall keeps protecting your office, but you lose the cloud features. Fortinet’s notice says that missing the window results in restricted cloud connectivity and the suspension of log uploads.
In practice, that can mean:
- No remote management through the cloud portal
- No cloud logs to look back on after a security incident
- A firewall that’s also behind on security fixes, which is the bigger risk
Remember that you need an active FortiCare support contract to download firmware at all. If yours has lapsed, sort that out first.
How the 7 days work
Fortinet says it sends a notice when the patch is published and another on the last day of the window. Those notices may go to whoever registered the firewall, so check who that is. If it’s a former IT contact, you may never see them. We saw the 5 December notice in the cloud portal itself, so log in and check its notifications too.
4 options under the Fortinet patch policy
| Option | What it means | Best for |
|---|---|---|
| 1. Patch by hand within 7 days | Someone watches for notices, books a window and upgrades each time | One firewall and someone reliable to do it |
| 2. Automatic upgrades in FortiOS | The firewall installs patches itself, at a time you set, with an optional delay | Most small and medium offices |
| 3. Standard subscription | Upgrades are scheduled from the cloud and can be postponed. It’s a paid licence | Several sites, or if you need more control |
| 4. Remove the firewall from the cloud service | The firewall works standalone, without cloud management or cloud logs | Sites that really don’t use the cloud service |
Fortinet’s firmware management guide has the details, and automatic upgrades are set up in FortiOS.
What we chose for a client firewall
For a professional services firm we manage in Georgetown, we chose option 2: automatic patches, with a 3-day delay, installing overnight between 02:00 and 05:00.
- The delay means a faulty patch has a few days to come to light before it reaches the client, while still landing well inside the 7 days.
- The overnight window keeps the short restart away from working hours. Anyone working late should know to expect it.
- Weekly firmware checks replaced monthly ones on our monitoring checklist.
- Major upgrades stay manual. Automatic patching only moves within the current firmware branch. Moving to a new branch is a planned job, with a backup and a check that connected switches and access points are compatible.
Your Fortinet patch policy checklist
- ✅ Find out whether your FortiGate is managed through FortiManagement Cloud
- ✅ Check whether it has a Standard subscription
- ✅ Confirm your FortiCare support contract is active
- ✅ Check that Fortinet’s notices reach someone who acts on them
- ✅ Check your firmware branch is still supported
- ✅ Choose one of the 4 options before 5 December
- ✅ Keep a current configuration backup off the firewall
- ✅ Make sure you’d get an alert if the firewall or an internet line went down after a restart
Who can manage FortiGate patching in Guyana?
Zenith Services Inc. (ZSI), a Guyanese IT and fire protection company based on the East Coast of Demerara, supplies, installs and manages FortiGate firewalls for businesses in Georgetown and across Guyana. Our managed clients get firmware updates planned, backed up, applied and checked for them. If you run two internet lines, see also our guide to business internet failover, and our checklist from Fortinet’s October security update.
Learn more about our cybersecurity services and managed IT services.
Not sure where your firewall stands on the Fortinet patch policy? Talk to our team and we’ll check it with you.
Frequently asked questions
Will my firewall stop working if I miss the 7 days?
No. Fortinet says the firewall continues to work standalone. You lose cloud access and log uploads until it’s patched.
Does this apply if I don’t use the cloud portal?
It applies to firewalls managed through FortiManagement Cloud without a Standard subscription. If yours is connected but you don’t use the service, you can remove it from the cloud.
Are automatic patches safe?
They’re generally the practical choice for a small office, but any update can cause problems. A short delay, an overnight window, a configuration backup and an outage alert reduce the risk.
Do automatic upgrades cover moving to a new firmware version like 7.6?
No. They cover patches within your current branch. Moving to a new branch should be planned separately.
Do I need a support contract?
Yes. Fortinet says a FortiCare contract with firmware and general updates is needed to upgrade.