CVE-2026-106173: 
FortiSIEM vulnerability analysis and mitigation

CVE-2026-106173 is a path traversal vulnerability (CWE-22) in Fortinet FortiSIEM that may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets. It affects FortiSIEM versions 7.0.0–7.0.4, 7.1.0–7.1.9, 7.2.0–7.2.7, 7.3.0–7.3.5, 7.4.0–7.4.2, and 7.5.0; FortiSIEM 7.6 and FortiSIEM Cloud are not affected. The vulnerability was disclosed on October 13, 2026, and was internally discovered by Gwendal Guégniaud of Fortinet's Product Security team. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 9.4 (Critical) per Fortinet's own advisory (Fortinet PSIRT, GitHub Advisory).

The vulnerability is rooted in improper limitation of a pathname to a restricted directory (CWE-22) within the grpc phQueryMaster component of FortiSIEM. An attacker can send specially crafted packets over TCP port 27918 to traverse directory boundaries and write or access files outside the intended restricted path, ultimately enabling arbitrary code or command execution. No authentication or user interaction is required, and attack complexity is low, making this exploitable by any network-reachable attacker. The specific mechanism involves path traversal sequences in gRPC packets that bypass server-side path validation (Fortinet PSIRT, GitHub Advisory).

Successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary code or commands on the FortiSIEM system, resulting in high confidentiality, integrity, and availability impact. Because FortiSIEM is a security information and event management platform, compromise could expose sensitive security telemetry, log data, and credentials from across the monitored environment, and could be leveraged for lateral movement into connected infrastructure. The attacker could also disable or tamper with security monitoring capabilities, effectively blinding defenders to ongoing attacks (Fortinet PSIRT).

As of the disclosure date (October 13, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported. The attack requires no authentication, no user interaction, and is network-accessible, which significantly lowers the barrier for exploitation if a PoC becomes available (Fortinet PSIRT, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FortiSIEM instances running versions 7.0.0–7.5.0 using tools like Shodan or Censys, targeting TCP port 27918 (gRPC phQueryMaster service).
2. Craft malicious gRPC packet: Construct a specially crafted gRPC packet containing path traversal sequences (e.g., ../../) in pathname parameters intended to reference files within a restricted directory.
3. Send packet to target: Transmit the crafted packet to the FortiSIEM host on TCP port 27918 without any authentication credentials.
4. Trigger path traversal: The server fails to properly sanitize the pathname, resolving the traversal sequence to a location outside the restricted directory — enabling file write, file read, or command execution depending on the specific traversal target.
5. Achieve code execution: Leverage the arbitrary file write or access capability to place a malicious payload (e.g., a script or binary) in an executable location, or directly trigger command execution through the vulnerable component (Fortinet PSIRT).

• Network: Unusual or unexpected connections to TCP port 27918 on FortiSIEM appliances from external or untrusted IP addresses; anomalous gRPC traffic volumes targeting the phQueryMaster service.
• Logs: FortiSIEM application logs showing path traversal sequences (e.g., ../, ..%2F, ..%5C) in gRPC request parameters; unexpected file access or write events outside normal application directories.
• File System: Presence of unexpected files (scripts, binaries, web shells) in directories outside the FortiSIEM application root; modification timestamps on system files inconsistent with normal operations.
• Process: Unusual child processes spawned by the FortiSIEM service (e.g., shell interpreters, network utilities like curl, wget, or nc); unexpected outbound network connections from the FortiSIEM host.

Fortinet has released FortiSIEM 7.5.1 as the patched version for the 7.5.x branch; users on earlier branches (7.0.x through 7.4.x) should upgrade to a fixed release as directed by Fortinet. As an immediate workaround, Fortinet recommends restricting access to TCP port 27918 at the network perimeter to prevent exploitation without upgrading. FortiSIEM 7.6 and FortiSIEM Cloud are not affected and require no action. Organizations should prioritize patching given the critical severity and unauthenticated attack vector (Fortinet PSIRT).

Security news outlet SecurityOnline.info covered the vulnerability as part of a broader Fortinet advisory roundup shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage. The vulnerability was internally discovered by Fortinet's own Product Security team, and no external researcher credit was given (Fortinet PSIRT).