CVE-2026-84389 in FortiSIEM
Summary
by MITRE • 09/08/2026
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Fortinet FortiSIEM versions ranging from 7.5.0 through 7.5.1 and 7.4.1 through 7.4.2 constitutes a critical open redirect flaw within the application's URL handling logic. This security defect arises when the software fails to adequately validate or sanitize user-supplied input that is used to construct redirection URLs. Instead of restricting redirects to trusted, internal domains explicitly defined in the configuration, the system accepts arbitrary external Uniform Resource Locators provided by an attacker. This lack of strict domain validation allows a malicious actor to manipulate the application into redirecting users to websites controlled by third parties, effectively bypassing standard security controls that rely on trusting the originating server's identity during navigation flows.
From a technical perspective, this flaw is classified under CWE-601, which defines URL Redirection to Untrusted Site or open Redirect. The vulnerability typically manifests in endpoints where authentication tokens, session cookies, or other sensitive state information are passed via query parameters or headers that persist across the redirect boundary. When an unsuspecting user clicks a link crafted by an attacker containing a maliciously constructed URL with a target domain parameter pointing to an external site, the FortiSIEM application processes this input and issues an HTTP 3xx response directing the browser to the untrusted destination. Because the redirection originates from a legitimate and trusted Fortinet domain, users are more likely to trust the link, assuming it is safe or part of their normal workflow with the SIEM platform.
The operational impact of this vulnerability extends beyond simple misdirection. Attackers can leverage open redirects for sophisticated phishing campaigns by masking malicious URLs behind the trusted FortiSIEM domain. This technique significantly increases the success rate of social engineering attacks because victims perceive the link as authentic, thereby lowering their suspicion levels. Furthermore, if the redirection occurs in a context where authentication credentials or session tokens are exposed during the transition to the external site, attackers can intercept these sensitive values. This could lead to unauthorized access to user accounts, privilege escalation within the SIEM environment, and potentially full compromise of the security monitoring infrastructure. In some configurations, this flaw may also facilitate cross-site scripting attacks if the redirect target is manipulated to reflect malicious script payloads back into the page context upon return or through subsequent interactions.
Mitigation strategies for this vulnerability involve both immediate patching and long-term architectural improvements. Fortinet has released updated versions of FortiSIEM that address these specific flaws by implementing strict allow-lists for redirection targets, ensuring that only pre-approved internal domains can be used in redirect operations. Administrators should immediately upgrade to the latest stable release within their supported version line to eliminate this attack vector. Additionally, organizations should enforce Content Security Policy headers where applicable and ensure that all users are trained to verify URL origins before entering credentials or sensitive data on redirected pages. Regular security audits of web application logic focusing on input validation for redirect parameters will further harden the environment against similar open redirect exploits in future updates.