FortiSIEM CVE-2026-106173: unauth RCE, PoC public, patch now

Fortinet patched CVE-2026-106173, a critical path-traversal flaw in FortiSIEM that lets an unauthenticated attacker run code on the appliance. It scores 9.4 on CVSSv3. Fortinet shipped the fix on October 13; on October 20, Horizon3.ai published a working proof-of-concept and a technical write-up. If you run FortiSIEM 7.5.0, treat this as exploit-imminent and upgrade.

The primary source is Fortinet's advisory FG-IR-26-180, which places the bug (CWE-22) in the appliance's gRPC phQueryMaster component and describes it as allowing "an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets." The CVE record is at NVD.

Affected versions

• FortiSIEM 7.5.0 — affected.
• FortiSIEM 7.6 — not affected, per Fortinet.
• Fix: upgrade to 7.5.1 or above.

Fortinet's advisory does not enumerate older 7.x branches by name; confirm your exact build against FG-IR-26-180 before assuming you're clear.

What the bug does

Per Horizon3.ai's analysis, the attacker connects to the FortiSIEM gRPC service on TCP port 27918 and abuses unsafe path construction in a SendQueryResult() routine. A user-supplied query-id parameter is appended to a file path without sufficient validation, and an embedded null byte truncates the intended filename suffix — so the attacker controls where the write lands and can overwrite a file outside the intended directory.

The practical escalation to code execution, as Horizon3.ai describes it, targets a shell script that health-checks Redis and is executed every 60 seconds by cron. Overwrite that script, wait up to a minute, and the attacker's commands run with the script's privileges. Zach Hanley, Horizon3.ai's chief attack engineer, is credited with the write-up.

Exploitation status

Fortinet's advisory does not report in-the-wild exploitation, and we've seen no confirmed-exploitation claim from a tracker as of this writing. What has changed is the public PoC: a reliable, documented exploit for an unauthenticated network-reachable RCE in a SIEM collector is exactly the kind of artifact that compresses the window from disclosure to mass scanning. The absence of an exploited-in-the-wild tag today is not a reason to wait.

Action checklist

1. Upgrade to FortiSIEM 7.5.1 or later per FG-IR-26-180. This is the only full fix.
2. If you cannot patch immediately, restrict network access to the gRPC service on TCP/27918 to trusted management hosts — it should never be internet-facing.
3. Hunt for tampering: review the Redis health-check script and its cron execution for unexpected modifications, and check for anomalous writes outside expected directories around the gRPC service.
4. Confirm whether any 7.5.0 collectors are exposed; a SIEM compromise hands an attacker your detection pipeline, so prioritize these over lower-value hosts.

Context

This is another unauthenticated RCE in a Fortinet security appliance reaching code execution through a file-write primitive — the recurring shape of appliance bugs that get mass-exploited once a PoC lands. Fortinet gear has a long record of post-disclosure exploitation on exactly this timeline. The appliance here is a SIEM: the system you'd rely on to detect the follow-on intrusion. Patch it before the scanners find it, not after.