CVE-2026-84389
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A URL redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0-7.5.1 and 7.4.1-7.4.2 may allow an attacker to execute unauthorized code or commands. The description does not provide the attack vector details.
Risk Assessment
An attacker can exploit the open redirect for phishing or redirecting users to malicious sites, potentially leading to credential theft. Unauthorized code execution may also be possible under certain conditions.
Recommendation
Update FortiSIEM to a patched version. Also, educate users about phishing and monitor network traffic.
Other vulnerabilities in FortiSIEM
See all- CVE-2025-25256Critical
An OS Command Injection vulnerability in Fortinet FortiSIEM allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests. Affects multiple versions from 4.7 to 7.3.1.
- CVE-2026-70467Low
A Server-Side Request Forgery (SSRF) vulnerability in Fortinet FortiSIEM in multiple versions may allow an attacker to execute unauthorized code or commands.
- CVE-2026-59838Medium
An XSS vulnerability in Fortinet FortiSIEM allows an attacker to inject malicious JavaScript code into a web page. The issue affects multiple FortiSIEM versions from 6.4 to 7.4.0.
Original NVD description (English source)
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS