Is CVE-2026-84389 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84389 being exploited in the wild.

How severe is CVE-2026-84389?

Low severity, with a CVSS score of 3.1, published 8 September 2026.

Which products and versions are affected?

Fortinet Fortisiem 7.4.1 through 7.4.2, 7.5.0 through 7.5.1.

Is there a fix for CVE-2026-84389?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-84389 attacked?

It is attacked over the network.

Am I affected by CVE-2026-84389?

Check whether you run Fortinet Fortisiem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84389: Fortinet FortiSIEM open redirect vulnerability

CVE-2026-84389 · Severity: low · CVSS 3.1 · Published 2026-09-08

FortiSIEM is a security information and event management platform used by enterprises to monitor and analyze security events across their infrastructure. An open redirect vulnerability allows an authenticated attacker to redirect users to arbitrary external websites through specially crafted HTTP requests, potentially enabling phishing attacks or malware distribution.

Technologies: Fortinet Fortisiem. Vendors: Fortinet.

Quick answers

Is CVE-2026-84389 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84389 being exploited in the wild.
How severe is CVE-2026-84389?: Low severity, with a CVSS score of 3.1, published 8 September 2026.
Which products and versions are affected?: Fortinet Fortisiem 7.4.1 through 7.4.2, 7.5.0 through 7.5.1.
Is there a fix for CVE-2026-84389?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-84389 attacked?: It is attacked over the network.
Am I affected by CVE-2026-84389?: Check whether you run Fortinet Fortisiem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a URL open redirect vulnerability (CWE-601) in the FortiSIEM GUI that allows authenticated attackers to craft HTTP requests containing malicious redirect parameters, causing the application to redirect users to untrusted external sites. The vulnerability affects FortiSIEM versions 7.4.1 through 7.4.2 and 7.5.0 through 7.5.1. Attack requires authentication and the victim must follow the malicious link. An attacker can leverage this to redirect users to phishing pages or malware distribution sites. Fortinet has released patches; users should upgrade to FortiSIEM 7.5.2 or above (7.5.x) or migrate to fixed releases (7.4.x).

Affected products

Fortinet FortiSIEM 7.4.1 through 7.4.2, 7.5.0 through 7.5.1

Timeline

2026-09-08: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-169

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.