Open Redirect on FortiSIEM
Low RiskCVSS 2.8FG-IR-26-169Sep 8, 2026
Fortinet
IT in OT - Fortinet products are commonly deployed at IT/OT network boundaries
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionRequired
Summary
An open redirect vulnerability exists in FortiSIEM that allows an attacker to redirect users to external websites through specially crafted URLs. The vulnerability requires user interaction (clicking a malicious link) and affects versions 7.5.0-7.5.1 and 7.4.1-7.4.2.
What this means
What could happen
An attacker could trick operators or administrators into visiting a malicious website by crafting a deceptive link within FortiSIEM, potentially leading to phishing attacks or credential theft. This does not directly impact device operations but poses a risk to personnel security.
Who's at risk
Security operations teams and system administrators who use FortiSIEM for log aggregation, event management, and security monitoring. This affects IT and OT personnel who access the FortiSIEM web interface for monitoring and incident response.
How it could be exploited
An attacker crafts a malicious URL containing a redirect parameter pointing to an external site, then sends it to a FortiSIEM user (e.g., via email or link in a report). When the user clicks the link and logs in to FortiSIEM, they are redirected to the attacker's site, which may impersonate FortiSIEM or execute a phishing attack.
Prerequisites
- User must click a malicious link
- User must be accessing FortiSIEM through a web browser
- Affected FortiSIEM version (7.4.1-7.4.2 or 7.5.0-7.5.1) must be deployed
remotely exploitableuser interaction requiredlow complexityactively exploited in limited scenarios (EPSS 0.1%)
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Affected products (2)
1 with fix1 pending
ProductAffected VersionsFix Status
FortiSIEM7.5.0 - 7.5.1No fix yet
FortiSIEM7.4.1 - 7.4.2Migrate to fixed release
Remediation & Mitigation
0/3
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
FortiSIEM
HOTFIXUpgrade FortiSIEM to a version newer than 7.5.1 or 7.4.2 (contact Fortinet support for available patched releases)
Long-term hardening
0/2FortiSIEM
HARDENINGDeploy email security controls or URL filtering to detect and block phishing attempts targeting FortiSIEM users
All products
HARDENINGImplement security awareness training for personnel to recognize and avoid clicking suspicious links in emails or messages
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/c8f65e4a-c9ec-463f-b93c-5d315e90dd09Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.