CVE-2025-47890

15th percentile - higher than 15% of all known CVEs

A CWE-601 URL Redirection to Untrusted Site vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests. The issue affects multiple versions including FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.0.x, 7.2.x, 6.4.x, FortiProxy 7.6.0-7.6.3, 7.4.x, 7.2.x, 7.0.x, and FortiSASE 25.2.a.

An attacker can exploit the open redirect to direct users to malicious sites, potentially leading to credential theft, malware infection, or other social engineering attacks.

Immediately update FortiOS, FortiProxy, and FortiSASE to patched versions. Consider implementing HTTP traffic filtering and monitoring for unusual redirects.