CVE-2026-84389: 
FortiSIEM vulnerability analysis and mitigation

CVE-2026-84389 is an open redirect (URL Redirection to Untrusted Site) vulnerability in Fortinet FortiSIEM that may allow an attacker to redirect users to arbitrary websites via specially crafted HTTP requests. It affects FortiSIEM versions 7.5.0 through 7.5.1 and 7.4.1 through 7.4.2; versions 7.3 and earlier, as well as 7.6, are not affected. The vulnerability was publicly disclosed on September 8, 2026, and carries a CVSSv3 base score of 3.1 (Low) per NVD and 2.8 (Low) per Fortinet's advisory (Fortinet PSIRT).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect') and resides in the FortiSIEM GUI component. An attacker can craft a malicious HTTP request that causes the application to redirect an authenticated user's browser to an arbitrary, attacker-controlled URL. Exploitation requires user interaction (the victim must follow or be tricked into following the crafted link) and has high attack complexity, with no privileges required on the attacker's side (Fortinet PSIRT).

Successful exploitation primarily affects integrity, enabling phishing attacks, credential harvesting, or delivery of malicious content by redirecting authenticated users to untrusted sites. Confidentiality and availability are not directly impacted by this vulnerability. The scope is limited to the affected FortiSIEM instance and its users, with no direct path to remote code execution or lateral movement (Fortinet PSIRT).

There are no known public proof-of-concept exploits or reports of in-the-wild exploitation as of the disclosure date. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and Fortinet's advisory confirms it has not been exploited in the wild. The EPSS score is approximately 0.136%, reflecting a low probability of exploitation in the near term (Fortinet PSIRT).

1. Reconnaissance: Identify FortiSIEM instances running versions 7.4.1–7.4.2 or 7.5.0–7.5.1 exposed via the web GUI, using network scanning or OSINT techniques.
2. Craft malicious URL: Construct a specially crafted HTTP request targeting the FortiSIEM GUI that includes a redirect parameter pointing to an attacker-controlled domain (e.g., https://fortisiem.target.com/some/path?redirect=https://attacker.com).
3. Deliver to victim: Send the crafted URL to an authenticated FortiSIEM user via phishing email, chat message, or other social engineering vector, since user interaction is required.
4. Achieve redirect: When the victim clicks the link and is authenticated to FortiSIEM, the application processes the malicious redirect parameter and forwards the user's browser to the attacker-controlled site, enabling phishing, credential harvesting, or malware delivery (Fortinet PSIRT).

• Network: Outbound HTTP redirects (301/302 responses) from the FortiSIEM GUI to external, non-organizational domains originating from FortiSIEM web server logs.
• Logs: FortiSIEM access logs showing requests with suspicious redirect or URL parameters containing external domains; look for parameters such as redirect=, url=, next=, or similar in GET/POST requests to the GUI.
• User Reports: Authenticated users reporting unexpected redirections to unfamiliar or suspicious websites after clicking FortiSIEM-related links.

Fortinet recommends upgrading FortiSIEM 7.5.x to the upcoming version 7.5.2 or above, and migrating FortiSIEM 7.4.x users to a fixed release. FortiSIEM 7.6 and versions 7.3 and earlier are not affected and require no action. No specific configuration-based workaround is provided; upgrading to a patched version is the primary remediation (Fortinet PSIRT).

The vulnerability was reported to Fortinet by external researcher khalooda0x (Khaled ibn Al-Walid) under responsible disclosure, and Fortinet acknowledged the contribution in their advisory. Given the low severity rating, there has been minimal notable community or media reaction beyond standard vulnerability tracking aggregators (Fortinet PSIRT).