FortiSIEM flaw gets public exploit code for remote code execution

A public proof-of-concept exploit is now available for a critical FortiSIEM vulnerability that can let an unauthenticated attacker execute code or commands on an affected system. The flaw is tracked as CVE-2026-106173 and carries a CVSS score of 9.4, according to Fortinet’s FortiGuard advisory.¹

The vulnerability is a path-traversal issue in FortiSIEM’s gRPC service. Fortinet says specially crafted packets can allow an unauthenticated attacker to execute unauthorised code or commands, making the issue relevant even where an attacker has not first obtained a valid account.¹

Security researchers at Horizon3.ai published the exploit analysis and proof of concept referenced by The Hacker News. Their analysis says the vulnerable handling of a query identifier can be abused to write files outside the intended directory. A second parsing weakness can then interfere with the filename FortiSIEM adds automatically, turning the file-write primitive into a route to remote code execution.²³

The vulnerable service uses TCP port 27918. Horizon3.ai says the attack chain involves crafted metadata and path-traversal sequences, with the final impact depending on which file can be overwritten and the privileges available to the service.² That makes exposure dependent on network access and deployment details, but does not remove the need to patch: the published proof of concept lowers the barrier to testing the vulnerability against reachable systems.

Fortinet’s advisory lists the affected release line as FortiSIEM 7.5.0 and directs administrators to upgrade to 7.5.1 or later. FortiSIEM 7.6 is listed as not affected by this issue.¹ Administrators should consult the vendor advisory for the complete product guidance, check whether port 27918 is exposed beyond trusted management networks, and review logs for unusual requests or unexpected file changes.

The disclosure follows the release of a patch rather than an unannounced zero-day. However, the combination of a high severity rating, unauthenticated access and public exploit code makes this a time-sensitive maintenance job for organisations running FortiSIEM 7.5.0. Security teams should treat internet-facing or broadly reachable instances as the priority and confirm the installed version rather than assuming a general Fortinet update covered the component.

FortiSIEM is Fortinet’s security information and event management platform, used to collect and correlate events across IT and operational technology environments. Fortinet describes the product as supporting threat detection, investigation and response, which also means an attack on the platform could affect the visibility and automation tools defenders rely on during an incident.⁴

Our opinion

This is the sort of vulnerability that deserves a faster response than its dense advisory language might suggest. A 9.4 score is important, but the practical warning signs are clearer: no authentication is required, the affected component is a security-management product, and researchers have published working exploit material. Those factors make inventory and patch verification more valuable than waiting for a convenient maintenance window.

The sensible response is not to panic or assume every FortiSIEM deployment is compromised. It is to identify affected 7.5.0 systems, upgrade them to 7.5.1 or later, verify that the service is not unnecessarily exposed, and investigate anomalous activity around the gRPC endpoint. If an organisation cannot patch immediately, restricting access to trusted management networks and increasing monitoring should be treated as temporary risk reduction, not a fix.¹²