PoC Released for Critical FortiSIEM RCE Flaw

Horizon3.ai has published a proof-of-concept exploit for CVE-2026-106173, a CVSS 9.8 unauthenticated remote code execution flaw in Fortinet FortiSIEM. Fortinet patched it October 14. If your deployment is still on FortiSIEM 7.5.0, update it now.

What the flaw is

CVE-2026-106173 is a path traversal combined with null byte injection in FortiSIEM’s gRPC service. The service processes untrusted metadata from incoming requests without proper path validation, and Horizon3.ai’s research confirms that an unauthenticated attacker can craft requests to write arbitrary files outside the intended directory. No credentials, no user interaction required.

Zach Hanley, Chief Attack Engineer at Horizon3.ai, published a technical writeup on the flaw. The Hacker News has a summary of Horizon3.ai’s findings.

The CVE-2026-106173 entry on this site has full background on the flaw, including exploitation scope.

Affected versions and what to do

Fortinet’s patch status:

• FortiSIEM 7.5.0: upgrade to 7.5.1 or higher
• FortiSIEM 7.6: not affected

Get the patch from Fortinet’s PSIRT portal. If patching immediately isn’t possible, restrict external network access to TCP port 27918 to reduce exposure. That’s a stopgap, not a fix.

Why this one moves up the queue

This CVE was patched October 14 as part of Fortinet’s Patch Tuesday advisory batch, which also covered Citrix and Ivanti flaws. See the full Patch Tuesday roundup for context. At that point, no exploitation had been confirmed.

A public PoC changes the calculus. Working exploit code is now available to anyone who reads security blogs. Exploitation attempts at unauthenticated RCE vulnerabilities this severity typically follow quickly after a public proof of concept.

FortiSIEM is a SIEM platform that aggregates log and event data from across an environment. An attacker who owns the FortiSIEM server can query that aggregated telemetry, not just control the host. The operational security impact of a compromise here extends well past the server itself.

Fortinet products have seen repeated active exploitation in 2026. CVE-2026-104286 in FortiMail hit CISA’s KEV catalog in early October, and a PeerStitch implant campaign chained Fortinet flaws against telecom targets last week. This product line is getting attention from threat actors. Patch before this one shows up in the KEV list too.