An Open Redirect flaw allows a remote attacker with system administrator privileges to trick authenticated users into visiting a malicious website by uploading a specially crafted CSV file. This vulnerability is classified as CWE‑601 and can be leveraged to facilitate phishing, credential theft, or further compromise when users interact with the redirected site.

Fortinet FortiNAC‑F software is affected. Versions 7.6.0 through 7.6.5, all 7.4 releases, and all 7.2 releases are vulnerable if the system administrator role is present and a CSV file can be processed by the appliance.

The CVSS base score of 2.2 indicates low severity, and no EPSS data is available, suggesting limited exploitation likelihood. The flaw is not listed in the CISA KEV catalog. Exploitation requires administrative privileges and the user’s interaction with the crafted CSV file, so the attack vector is primarily administrative and user‑based rather than remote unauthenticated.