Security researchers at Horizon3.ai have published a working proof-of-concept (PoC) exploit for CVE-2026-106173, a critical flaw in Fortinet’s FortiSIEM security monitoring product. Fortinet rates it 9.4 and describes it as an unauthenticated path traversal that can let an attacker run unauthorized code or commands through specially crafted packets. Fortinet published the fix on October 13, and its advisory listed the issue as not known to be exploited at the time of our reading.
Horizon3.ai’s write-up says the attacker connects to the FortiSIEM gRPC service on TCP port 27918. A “query-id” value in the request is used to build a file path without proper checks, so ../ sequences let the attacker escape the intended folder. A null byte in the same value makes the system ignore the file name the software would otherwise append, so the attacker controls the exact file that gets overwritten. In the researchers’ example, that file is a shell script that a cron job runs every 60 seconds, which turns the file write into code execution. With a public PoC now available, anyone still on the vulnerable version should treat the upgrade as urgent.
How to check if you’re affected
Affected versions: Fortinet lists FortiSIEM 7.5.0 as vulnerable and fixed in 7.5.1 or above. FortiSIEM 7.6 is not affected, and Fortinet says FortiSIEM Cloud is not affected. Check your version in the FortiSIEM interface or with your usual appliance inventory.
If you run 7.5.0, upgrade to 7.5.1 or later. Fortinet’s workaround is to restrict access to TCP port 27918, so that only systems that need it can reach it. Fortinet’s advisory lists no virtual patch for this flaw.