CVE-2026-84389
published 2026-09-08CVE-2026-84389: A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker…
PriorityP411low3.1CVSS 3.1
AVNACHPRNUIRSUCNILAN
EPSS
0.22%
11.6th percentile
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortisiem | 7.4.1 – 7.4.2 | — |
| fortinet | fortisiem | 7.5.0 – 7.5.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Fortinet FortiSIEM up to 7.4.2/7.5.1 redirect (Nessus ID 346824)
vuldb·2026-09-17·CVSS 3.1
CVE-2026-84389 [LOW] Fortinet FortiSIEM up to 7.4.2/7.5.1 redirect (Nessus ID 346824)
A vulnerability described as problematic has been identified in Fortinet FortiSIEM up to 7.4.2/7.5.1. This impacts an unknown function. The manipulation results in open redirect.
This vulnerability is identified as CVE-2026-84389. The attack can be executed remotely. There is not any exploit available.
GHSA
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands
ghsa_unreviewed·2026-09-08
CVE-2026-84389 [LOW] CWE-601 A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-08
Published