CVE-2026-21741
Open Redirect in Fortinet FortiNAC Allows Admin-Driven Phishing
Publication date: 2026-04-14
Last updated on: 2026-04-20
Assigner: Fortinet, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fortinet | fortinac-f | From 7.2.0 (inc) to 7.6.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Open Redirect issue (CWE-601) found in Fortinet FortiNAC-F versions 7.6.0 through 7.6.5, 7.4 all versions, and 7.2 all versions. It allows a remote attacker who has system administrator privileges to redirect users to an arbitrary website by using a specially crafted CSV file.
How can this vulnerability impact me? :
The vulnerability can impact you by enabling a remote privileged attacker to redirect users to malicious or untrusted websites. This could potentially be used for phishing attacks or to trick users into visiting harmful sites, although the attacker must already have system administrator privileges to exploit it.