CVE-2026-84389: Fortinet FortiSIEM Open Redirect Vulnerability

CVE-2026-84389 Overview

CVE-2026-84389 is an open redirect vulnerability [CWE-601] affecting Fortinet FortiSIEM. The flaw exists in FortiSIEM versions 7.5.0 through 7.5.1 and versions 7.4.1 through 7.4.2. An attacker can craft a URL that redirects users to an untrusted external site after interaction with a FortiSIEM link. Successful exploitation may allow the attacker to execute unauthorized code or commands within the user's session context.

Critical Impact
The vulnerability enables attackers to redirect authenticated FortiSIEM users to attacker-controlled destinations, facilitating phishing and credential harvesting campaigns against security operations personnel.

Affected Products

Fortinet FortiSIEM 7.5.0 through 7.5.1
Fortinet FortiSIEM 7.4.1 through 7.4.2
Deployments exposing the FortiSIEM web interface to untrusted networks

Discovery Timeline

2026-09-08 - CVE-2026-84389 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-84389

Vulnerability Analysis

The vulnerability is classified as an open redirect flaw under [CWE-601]. FortiSIEM accepts a URL parameter and forwards the client to that destination without validating whether the target belongs to a trusted domain. Exploitation requires attacker-crafted input to reach the affected redirect endpoint and requires the victim to click the malicious link.

Successful attacks abuse the trust that users place in the legitimate FortiSIEM hostname. The attack complexity is high because specific conditions must align for the redirect to execute unauthorized code or commands in the user's browser context. Confidentiality is not directly impacted, but limited integrity impact is possible through session manipulation or chained attacks.

Root Cause

The root cause is insufficient validation of user-supplied URL parameters used by the FortiSIEM web application when constructing redirect responses. The application trusts the destination value and issues an HTTP redirect without enforcing an allowlist of permitted hosts or paths. This design allows arbitrary external URLs to be substituted into the redirect flow.

Attack Vector

An unauthenticated attacker constructs a URL pointing to the vulnerable FortiSIEM redirect endpoint, embedding an attacker-controlled destination. The attacker delivers this link through phishing email, chat, or a compromised web page. When the victim clicks the link, the FortiSIEM instance issues a redirect to the attacker's site. The attacker's page may then impersonate FortiSIEM login prompts or serve malicious scripts. Refer to the Fortinet PSIRT Advisory FG-IR-26-169 for vendor-supplied technical details.

Detection Methods for CVE-2026-84389

Indicators of Compromise

FortiSIEM web server access logs containing redirect requests with external url, redirect, or next parameter values that do not match the organization's approved domains.
Outbound HTTP 302 responses from FortiSIEM endpoints pointing to newly registered or low-reputation domains.
Phishing emails referencing the organization's FortiSIEM hostname combined with suspicious query strings.

Detection Strategies

Inspect web proxy and reverse proxy logs for redirect chains originating from FortiSIEM hostnames and terminating on external destinations.
Deploy signatures on web application firewalls that flag redirect parameters containing fully qualified external URLs or protocol-relative paths.
Correlate user authentication anomalies immediately following clicks on FortiSIEM URLs delivered via email.

Monitoring Recommendations

Forward FortiSIEM access logs to a centralized analytics platform and alert on redirect responses to non-corporate domains.
Monitor email security gateway telemetry for inbound messages containing links to the FortiSIEM management interface.
Track user reports of unexpected login prompts appearing after clicking internal-looking FortiSIEM URLs.

How to Mitigate CVE-2026-84389

Immediate Actions Required

Upgrade FortiSIEM to a fixed release as identified in Fortinet PSIRT Advisory FG-IR-26-169.
Restrict access to the FortiSIEM web interface to trusted management networks and administrator workstations.
Educate SOC analysts and administrators to inspect the full destination of FortiSIEM URLs before authenticating.

Patch Information

Fortinet has published remediation guidance in advisory FG-IR-26-169. Administrators should consult the Fortinet PSIRT Advisory FG-IR-26-169 to identify fixed FortiSIEM builds and apply the vendor-recommended upgrade path for both the 7.4.x and 7.5.x branches.

Workarounds

Place FortiSIEM behind a reverse proxy or web application firewall that strips or validates redirect parameters against an allowlist of internal hosts.
Enforce browser-side protections such as strict referrer policies and warn users about clicking FortiSIEM links delivered from external sources.
Where feasible, disable direct external access to the FortiSIEM management URL and require VPN authentication before reaching the interface.

bash

# Configuration example: WAF rule concept to block external redirect targets
# Reject requests where redirect-style parameters point outside approved domains
SecRule ARGS:url|ARGS:redirect|ARGS:next "@rx ^(https?:)?//(?!fortisiem\.internal\.example\.com)" \
    "id:1026084389,phase:2,deny,status:403,msg:'Blocked FortiSIEM open redirect attempt (CVE-2026-84389)'"