Open Redirect CVE-2026-21741

Despite the CVSS score of 2.4 (low severity), multiple signals indicate genuinely limited real-world risk. The CVSS vector PR:H (high privilege required) and UI:R (requires user interaction) substantially restrict exploitability-an attacker must already have system administrator credentials and trick a user into clicking a link. The integrity impact is limited (I:L) with no confidentiality or availability impact. EPSS exploitation probability data is not provided, but the attack requirements alone suggest exploitation is difficult in typical environments. The attack is not confirmed as actively exploited (no KEV status provided), and no public exploit code is referenced. This is a credible but low-priority vulnerability suitable for standard patch management cycles rather than emergency response. Organizations with strong administrative access controls and user security awareness training face minimal practical risk.

A malicious actor with compromised or stolen system administrator credentials creates a crafted CSV file containing URLs pointing to a phishing site. The attacker uploads this file to FortiNAC-F through the management interface. When the device processes and exports this CSV or presents it to end users in a report or notification, users who click embedded links are redirected to the attacker's site without warning, enabling credential theft or malware distribution. Exploitation requires prior administrative access, making this a lateral movement or privilege-abuse vector rather than an initial entry point.