FortiOS 7.0.18 release notes

FortiOS 7.0.18 is no longer vulnerable to CVE-2025-25249. See the FortiGuard PSIRT portal for more information.

FortiOS 7.0.18 is no longer vulnerable to CVE-2025-53844. See the FortiGuard PSIRT portal for more information.

FortiOS 7.0.18 is no longer vulnerable to CVE-2025-59718. See the FortiGuard PSIRT portal for more information.

Supported upgrade paths depend on the FortiGate model, current FortiOS version, and target version. In the Fortinet Document Library, open Tools & Resources > Upgrade Path Tool, choose FortiGate / FortiOS, select the model, current version, and target version, then click Go.

An invalid value set for the dhcp-renew-time attribute no longer causes an error while restoring configuration in an HA cluster.

The new kernel platform now processes UDP-encapsulated ESP packets when a custom ike-port is used.

A WAD crash in one of its functions under certain corner cases has been fixed.

A FortiGate memory-usage issue caused by the WAD process after an upgrade has been fixed.

A WAD signal 11 crash on FortiGate devices has been fixed.

SSL VPN web-mode Telnet and SSH pages no longer remain loading without presenting a login page.

SSL VPN web-mode SSH now works after upgrading from the affected 7.0.16 release.

SSH and Telnet service disruption caused by incorrectly removing hterm_all.js from the SSL VPN web portal has been fixed.

SAML authentication issues have been fixed when LASSO_PROFILE_SIGNATURE_VERIFY_HINT_FORCE is set and the SAML response is unsigned.

If the first firewall service object in CLI table order has protocol type IP, creating another IP service in the GUI may incorrectly modify the first object's protocol number. This can affect policies, including those using ALL on some 6K/7K platforms. Workaround: create the service in the CLI or place a non-IP service first, for example: `config firewall service custom`; `edit "unused"`; `set tcp-portrange 1`; `next`; `move "unused" before "ALL"`; `end`.

After upgrading a FortiManager-managed FortiGate to 7.0.13, the Firewall Policy list may create separate sequence groups because global-label becomes unique for each policy. Workaround: drag policies into the correct GUI group, or remove global-label from each member except the leading policy.

For local-out DNAT traffic, the best output route may not be found.

Graceful upgrade of a FortiGate 6000 or 7000 FGCP HA cluster is unsupported from FortiOS 7.0.12 to 7.2.5 or 7.2.6. Perform the upgrade in a maintenance window because traffic can be disrupted for up to 30 minutes. Disable `uninterruptible-upgrade` and perform a normal firmware upgrade; traffic remains unavailable until all management boards and FPCs, or FIMs and FPMs, are upgraded and both FortiGates restart.

Traffic-flow conflicts may occur when One-to-One is used as a NAT policy.

Fragment packets with `DEI == 1` do not work on FortiGate 6000/7000 platforms.

The Category filter on Dashboard > FortiView Websites does not work in the Japanese GUI.

System > FortiGuard may show Unknown for a working override FortiGuard server used for AntiVirus and IPS updates. This is display-only; override operation is unaffected.

With VDOM mode enabled, Network > Interfaces in Global view may show non-management VDOM IPsec tunnel interfaces as UP. The VDOM view reports the correct status.

Policy & Objects > Firewall Policy can take about 30 seconds or more to load with over 20,000 policies. Workaround: configure policies through the CLI.

System > Certificates may show an incorrect reference count and allow an attempted deletion of a referenced certificate. The deletion fails even though the GUI reports success; deletion works after all references are removed.

Users cannot paste text into the SSL VPN web portal SSH terminal emulator in Firefox. Workaround: use Chrome, Edge, or Safari.

When upgrading from 7.0.1 to 7.0.2, the GUI incorrectly warns that the upgrade path is invalid.

An undefined error appears when changing an administrator password for the first time on NP7 platforms.

The View/Edit Entries pane under Policy & Objects > Internet Service Database cannot scroll to the end when it contains over 100,000 entries.

Editing a prefix list with many rules under Network > Routing Objects can fail with an integer-range error. Workaround: edit the prefix list through the CLI.

With more than 200 VDOMs, System > Administrators may take over one minute to load the Two-factor Authentication toggle. Other settings are unaffected. Workaround: configure `two-factor-authentication` under `config system admin` in the CLI.

The GUI may report an expired device-level FortiManager Cloud license even when a valid account-level license exists. Functionality is unaffected.

On FortiGate 12xG and 9xG series devices, graceful upgrade of the secondary HA node fails when security level is high. Workaround: disable HA and upgrade units separately, or lower the security level for the upgrade and restore it afterward.

Hyperscale firewall policies do not support VIP features srcfltr, srcintf-fltr, service, arp-reply, nat-source-vip, or portforwarding, although these options appear in the CLI or GUI for IPv4 and IPv6 VIPs in a hyperscale VDOM.

HA1, HA2, AUX1, and AUX2 interfaces on FortiGate 4200F, 4201F, 4400F, and 4401F cannot be added to an LAG.

Sessions using hyperscale policies with hardware logging may be dropped when `log-processor` is changed dynamically from `hardware` to `host`. Change the setting during a quiet period.

The implicit-deny policy hit count does not increment for hardware sessions carrying NAT46 or NAT64 traffic.

`srcaddr-negate` and `dstaddr-negate` do not work correctly for IPv6 traffic with FTS.

New ACL policies on a busy hyperscale VDOM may take longer than expected to become effective. During the transition, traffic that should be blocked may be allowed.

The npu-session list does not display policy-route information when accelerated traffic uses a policy route.

A diagnostic command to show hit_count and last_used for policy routes and NPU sessions is unavailable in a hyperscale VDOM.

The console can display `PARSE SKIP ERROR=17 NPD ERR PBR ADDRESS` during system startup.

The `diagnose firewall ippool list` command does not show correct output for overload-type IP pools.

Editing a hyperscale policy using an overload CGN IP pool causes the GUI to disable `cgn-eif` regardless of its prior state.

The out-of-memory killer may terminate the NPD or LPMD process after mixed-session traffic and an HA failover.

The `diagnose sys npu-session stat` command incorrectly reports a setup rate of 0 for EIF sessions.

Hardware session synchronization does not work on FG-480xF devices in hyperscale mode.

The HA primary can show many entries in the npu-session list while npu-session state reports 0.

A kernel interruption can occur in a hyperscale VDOM when `set nat46-generate-ipv6-fragment-header` is enabled.

After FTP traffic passes, `npu-session stat` does not report the accurate number of sessions.

An IPsec aggregate static route is not marked inactive when the IPsec aggregate is down.

Disabling `src-check` on the parent tunnel is not inherited by ADVPN shortcuts.

Traffic logs may not be generated for firewall traffic when numerous configuration changes occur simultaneously.

FortiGate may enter conserve mode when a non-date or invalid HTTP date is posted through the web proxy.

FortiClient cannot connect to FortiGate SSL VPN with SAML when an internal browser is used as the SAML user-authentication agent.

GUI performance is slow in a Fabric topology with over 50 downstream devices.

Security Rating reports show incorrect results for Rogue AP Detection and FortiCare Support checks.

On FortiGates with tables exceeding 1,000 firewall policies, addresses, or other entries, Security Rating reports may cause conserve mode.

Security Fabric physical and logical topology views are slow with many downstream FortiGates, FortiSwitches, FortiAPs, and endpoint traffic. This is GUI-only and does not affect downstream operation.

The console may display `mce: [Hardware Error]` after a fresh image burn or reboot.

An 802.3ad aggregate configured at 1 Gbps can have an unlit port LED and pass no traffic on 110xE, 220xE, 330xE, 340xE, and 360xE platforms.

cmdbsvr may be unable to secure the var_zone lock because another process holds it indefinitely.

After reboot, the console may print `check_gui_redir_file: No such file or directory`.

FortiGate 200F can experience slow uploads and downloads for traffic traversing from a 1G interface to a 10G interface.

Certain FortiGate models can experience CPU spikes and management-access problems after an upgrade when IPsec Phase 1 NPU offload is enabled during maintenance.

Upgrading from FortiOS 7.0.15 to 7.0.16 with BIOS security level 2 may report `System file integrity check failed!`.

An ESXi VLAN interface based on LACP does not function.

ARM64 KVM, AWS, and OCI FortiGate VMs and VM64 OPC may encounter a kernel error when upgrading from 7.0.15 to 7.0.16. The OCI bare-metal kernel image is unsupported in 7.0.16 when upgrading from 7.0.13, 7.0.14, or 7.0.15.

The block replacement page is not automatically pushed to replace video content when a video filter blocks it.

With over 500 managed FortiAPs and over 5,000 WiFi clients, the Managed FortiAPs page and FortiAP Status widget can load slowly. FortiAP operation is unaffected.

After an upgrade or reboot on NP7 platforms, WiFi data may not pass when the SSID VLAN interface uses DHCP Relay Server.

Mapped drives become inaccessible after a laptop reboots when FortiGate ZTNA access proxy uses FQDN destinations.

ZTNA TCP forwarding does not work when the real server uses an FQDN address type. Publicly resolving FQDNs are not recommended because the internal DNS database zone can override resolution; after reboot, the private address may not take effect and the real server may not be found.

Fortinet states that no new issues have currently been identified in FortiOS 7.0.18; all listed known issues originated in previous FortiOS versions and remain open in 7.0.18.