CVE-2026-21741: FortiNAC-F Open Redirect Vulnerability

CVE-2026-21741 Overview

CVE-2026-21741 is an Open Redirect vulnerability (CWE-601) affecting Fortinet FortiNAC-F network access control appliances. This vulnerability allows a remote attacker with system administrator privileges to redirect legitimate users to arbitrary malicious websites through a specially crafted CSV file. While exploitation requires high privileges, successful attacks could be leveraged for phishing campaigns or credential harvesting against users who trust the FortiNAC-F administrative interface.

Critical Impact

Authenticated administrators can abuse CSV import functionality to inject malicious redirect URLs, potentially compromising users who click on links generated from imported data.

Affected Products

• FortiNAC-F version 7.6.0 through 7.6.5
• FortiNAC-F version 7.4 (all versions)
• FortiNAC-F version 7.2 (all versions)

Discovery Timeline

• 2026-04-14 - CVE-2026-21741 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-21741

Vulnerability Analysis

This Open Redirect vulnerability resides in the CSV file import functionality of Fortinet FortiNAC-F. The application fails to properly validate and sanitize URL parameters contained within imported CSV data, allowing malicious redirects to be embedded within the system. When users interact with links generated from the imported data, they can be silently redirected to attacker-controlled websites.

The vulnerability requires the attacker to have system administrator role access to the FortiNAC-F interface, which limits the attack surface. However, in environments where administrative credentials are compromised or where insider threats exist, this vulnerability could be weaponized for targeted phishing attacks against organization users.

Root Cause

The root cause is improper input validation (CWE-601) in the CSV parsing and URL handling components of FortiNAC-F. When processing CSV file imports, the application does not adequately verify that URL fields point to trusted destinations before storing and subsequently presenting them to users. This allows arbitrary URLs to be injected and later used to redirect unsuspecting users.

Attack Vector

The attack is network-based and requires the following conditions:

1. High Privileges Required: The attacker must possess system administrator role credentials
2. User Interaction: A victim user must click on a link generated from the malicious CSV data
3. Crafted CSV File: The attacker creates a CSV file containing malicious redirect URLs in appropriate fields

The attack flow involves an administrator uploading a crafted CSV file containing malicious URLs. These URLs are then stored in the system and presented to users through the normal interface. When users click on these seemingly legitimate links, they are redirected to attacker-controlled websites where credential theft, malware delivery, or further social engineering can occur.

The vulnerability is exploited through the CSV import functionality where URL fields are not properly validated. An attacker with administrative access would craft a CSV file containing malicious redirect URLs in fields that are later rendered as clickable links within the FortiNAC-F interface. For detailed technical information, refer to the Fortinet Security Advisory FG-IR-26-118.

Detection Methods for CVE-2026-21741

Indicators of Compromise

• Unusual CSV file uploads to FortiNAC-F administrative interface containing external URLs
• User complaints about unexpected redirects when clicking links within FortiNAC-F
• Web proxy logs showing redirections from FortiNAC-F interface to unknown external domains
• Administrative audit logs showing bulk CSV imports from untrusted sources

Detection Strategies

• Monitor FortiNAC-F administrative audit logs for CSV file import activities, especially from new or unusual administrator accounts
• Implement web proxy rules to detect and alert on redirects from FortiNAC-F to untrusted external domains
• Review uploaded CSV files for presence of external URLs or suspicious redirect patterns
• Enable enhanced logging for all administrative operations on FortiNAC-F appliances

Monitoring Recommendations

• Configure SIEM alerts for CSV import operations performed by administrator accounts
• Implement URL reputation checking for any external URLs stored within FortiNAC-F database
• Monitor for user sessions that navigate from FortiNAC-F interface to external domains
• Establish baseline administrative behavior patterns to detect anomalous CSV import activities

How to Mitigate CVE-2026-21741

Immediate Actions Required

• Review all administrator accounts on FortiNAC-F and ensure only trusted personnel have system administrator role access
• Audit recent CSV file imports for any suspicious or malicious URL content
• Implement additional access controls and multi-factor authentication for administrative functions
• Consider temporarily restricting CSV import functionality until patches are applied

Patch Information

Fortinet has released security updates to address this vulnerability. Organizations should upgrade FortiNAC-F to the latest patched version as specified in the Fortinet Security Advisory FG-IR-26-118. Contact Fortinet support or access the FortiGuard portal for the latest firmware updates.

Workarounds

• Limit system administrator role access to only essential personnel with verified credentials
• Implement a review process for all CSV file imports before they are processed by the system
• Use network segmentation to restrict where FortiNAC-F users can be redirected
• Enable web filtering on corporate proxies to block redirects to known malicious domains
• Consider disabling CSV import functionality if not business-critical until patches are deployed

Administrative controls should be reviewed to ensure proper separation of duties. Organizations can implement additional validation by requiring manual approval for CSV imports containing external URLs. Access the FortiGuard PSIRT portal for detailed remediation guidance and patch availability information.