Fortinet FortiSIEM and FortiSandbox GUI Unauthenticated RCE

CVE-2026-106173 is a CVSS 9.8 remote code execution vulnerability in the graphical interfaces of Fortinet FortiSIEM and FortiSandbox. An unauthenticated attacker with network access to the affected interface can execute arbitrary code on the host. No credentials and no user interaction are required.

FortiSIEM is a security information and event management platform used to aggregate, correlate, and alert on security telemetry across an enterprise environment. FortiSandbox is a sandboxing appliance for dynamic analysis of potentially malicious files and URLs. Both expose web-based graphical interfaces for administration and analysis. In CVE-2026-106173, a flaw in that interface’s request handling allows unauthenticated input to reach code execution paths, giving a remote attacker command-level access to the host without first providing valid credentials.

Fortinet released patches for both products on October 14, 2026, as part of a broader October advisory batch that addressed 13 vulnerabilities across 10 advisories. See Fortinet’s security advisories portal for version-specific patch information.

FortiSIEM and FortiSandbox are security operations tools, and a compromise of either has operational security implications beyond the server itself. An attacker with access to the FortiSIEM backend can query aggregated log data across all sources feeding into it, including network devices, endpoints, and other security controls. Organizations should treat a CVSS 9.8 unauthenticated RCE on these products as high urgency even in the absence of confirmed in-the-wild exploitation.

None of the October 14 Fortinet CVEs are currently confirmed as exploited in the wild, though Fortinet products have appeared in CISA’s Known Exploited Vulnerabilities catalog repeatedly in 2026, including CVE-2026-104286 in FortiMail earlier this month. Patch now rather than waiting for a KEV confirmation.

FAQ

Which Fortinet products are affected?

CVE-2026-106173 affects FortiSIEM and FortiSandbox graphical interfaces. Specific affected version ranges will appear in Fortinet’s security advisory; check Fortinet’s PSIRT portal for version details and patch packages.

Is this exploited in the wild?

Not confirmed as of October 14, 2026. Fortinet has not indicated active exploitation in its advisory. Given the CVSS 9.8 score and the unauthenticated attack path, applying the patch before that changes is the appropriate course of action.

How does this compare to other recent Fortinet CVEs?

CVE-2026-104286, patched and added to CISA KEV on October 2, was a zero-day in FortiMail that was actively exploited. CVE-2026-106173 is not described as exploited at publication, but the attack surface (unauthenticated, network-accessible, RCE) is similar in character. The same patch window that clears Patch Tuesday backlog is the right time to apply the Fortinet October updates.