Public exploit released for unauthenticated FortiSIEM RCE (CVE-2026-106173)
Horizon3.ai’s proof of concept writes files via unauthenticated gRPC on port 27918; 7.5.1 fixes 7.5.0, and 7.6 is unaffected.
74
Product
FortiSIEM
- Mentions · 7d0
- Mentions · 30d7
- All mentions10
- First seenAug 12, 2026
- Last mentioned9d ago
Timeline
10 articles · newest firstPublic PoC turns FortiSIEM file-write flaw into unauthenticated RCE
Horizon3.ai's GitHub PoC targets FortiSIEM 7.5.0 over TCP 27918; Fortinet advises 7.5.1 or later.
74
Public PoC targets critical FortiSIEM unauthenticated RCE (CVE-2026-106173)
Horizon3.ai shows a gRPC path traversal on port 27918 that overwrites a cron-run Redis health script.
67
FortiSIEM gRPC flaw allows unauthenticated file-write RCE
phQueryMaster on tcp/27918 accepts any client, and a crafted query id can overwrite a cron-run script.
76
Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
52
Broken authorization
Fortinet reports a low-severity FortiSIEM authorization flaw that authenticated attackers can abuse.
32
Arbitrary file write in grpc phQueryMaster
Fortinet warns of a CVSS 9.4 FortiSIEM path traversal letting unauthenticated attackers run commands.
74
Fortinet security advisory (AV26-023) - Update 1
CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.
60
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.
58
Server-Side Request Forgery (SSRF)
Fortinet discloses a low-severity SSRF in the FortiSIEM GUI allowing authenticated attackers to send requests from targeted devices.
20
Related CVEs
by mentions- CVE-2026-106173<1%9.8Path traversal to remote code execution in FortiSIEM 7.5.0
- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2026-26084<1%9.9Improper Access Control in Fortinet FortiSandbox Exposes Sensitive Data
- CVE-2025-47855<1%9.8An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through…
- CVE-2025-6415544%9.8Unauthenticated RCE via OS Command Injection in Fortinet FortiSIEM
- Sensitive Information in Source Code in Fortinet FortiMonitorOnSight (CVSS 9.8)
- CVE-2026-84388<1%9.6Unauthenticated UI-Layer Flaw in Fortinet FortiPAM Chrome Extension
- CVE-2026-84393<1%8.1Certificate Host-Mismatch Validation Flaw in FortiOS and FortiProxy ZTNA
Appears with
- Fortinetvendor · 10
- Horizon3.aiorganization · 4
- FortiAnalyzerproduct · 2
- Canadian Centre for Cyber Securityorganization · 2
- FortiManagerproduct · 2
- Fortinetorganization · 2
- FortiSandboxproduct · 2
- FortiOSproduct · 2
- FortiSandbox PaaSproduct · 1
- FortiSOARproduct · 1
- FortiPAMproduct · 1
- FortiFoneproduct · 1
- FortiMailproduct · 1
- CISAorganization · 1
- FortiSASEproduct · 1
- FortiProxyproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.