A public proof-of-concept (PoC) exploit has been released for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM that allows a remote, unauthenticated attacker to write files to the appliance and potentially execute code.
The vulnerability affects FortiSIEM version 7.5.0. Fortinet issued a patch in FortiSIEM 7.5.1; FortiSIEM 7.6 is reported not to be affected.
Fortinet disclosed the issue on October 13, 2026, via a FortiGuard advisory. Security researcher Horizon3.ai subsequently published technical analysis and a PoC implementation on GitHub.
Horizon3.ai’s research shows that an unauthenticated client can connect to a gRPC service listening on TCP port 27918 and abuse the SendQueryResult method to write attacker-controlled data to the appliance’s filesystem.
The gRPC service accepts query-result data and constructs a file path using values supplied by the client. The researchers found the service fails to validate the query ID properly before incorporating it into the path. By inserting directory-traversal sequences, an attacker can cause the service to write files outside the intended query-results directory.
The service appends its own text to the end of generated filenames, but Horizon3.ai discovered that placing a null byte in a crafted field can make the operating system treat the path as if it ended earlier. That behavior lets an attacker target an existing, exact filename instead of being limited to the service-created name. Crafting and sending such a request requires manually building the gRPC message because common tools and libraries often block null bytes in headers.
Fortinet FortiSIEM RCE Vulnerability
The insecure file-write can be escalated to remote code execution if an attacker overwrites a script or binary that the appliance runs automatically. Horizon3.ai identified /opt/charting/redishb.sh — reported to be executed by a scheduled job — as a script of interest. The researchers also named /opt/phoenix/bin/phLicenseTool as a file administrators should inspect.
While the published PoC demonstrates the exploit technique and risk, its release by itself does not indicate that any specific FortiSIEM installation has been compromised.
Administrators should verify whether their FortiSIEM appliances are running version 7.5.0 and upgrade to 7.5.1 or later. If an immediate upgrade is not possible, restrict access to TCP port 27918 to trusted management systems and ensure the port is not reachable from the public internet. Note that FortiSIEM 7.6 is reported not to be affected.
Horizon3.ai reports it did not find application logs that definitively show exploitation of this vulnerability. Teams investigating potential compromise should review file modification timestamps and examine the named scripts for unexpected changes. Unusual timestamp mismatches with nearby system files may justify a deeper investigation, though such mismatches alone are not proof of exploitation.
This issue joins a string of FortiSIEM vulnerabilities reported by Horizon3.ai, including CVE-2024-23108 and CVE-2025-64155. Earlier problems involved the phMonitor service; CVE-2026-106173, by contrast, targets a separate gRPC service. Defenders should note that hardening or monitoring one FortiSIEM service does not automatically protect others.
Update defenses against new malware as soon as it appears. Integrate TI feeds with data from 16K SOCs.
