Public PoC targets critical FortiSIEM unauthenticated RCE (CVE-2026-106173)
Original title: Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Horizon3.ai shows a gRPC path traversal on port 27918 that overwrites a cron-run Redis health script.
Horizon3.ai published a proof-of-concept for CVE-2026-106173, a critical path-traversal flaw in Fortinet FortiSIEM with a CVSS score of 9.4. An unauthenticated attacker can reach the gRPC service on TCP port 27918, escape the intended directory, and overwrite files, including a Redis health-check script run every 60 seconds. Fortinet issued patches last week: FortiSIEM 7.5.0 should be upgraded to 7.5.1 or above, and 7.6 is not affected. The report does not describe attacks in the wild.
Unconfirmed: The report does not say whether attackers have used the public PoC.
- SendQueryResult() uses a user-supplied query-id without sufficient path checks.
- A NUL byte in query-id drops the appended result filename.
- One path overwrites /opt/charting/redishb.sh while keeping its permissions.
- A second variant uses two requests to create a new named file.
- FortiSIEM 7.6 is stated as not affected.
Impact: Unauthenticated remote code execution via arbitrary file overwrite
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiSIEM | 7.5.0 | 7.5.1 or above |
- 1.Upgrade FortiSIEM 7.5.0 to 7.5.1 or above.
- CVEs
- CVE-2026-106173
- Vendors
- Fortinet
- Products
- FortiSIEM
- Organizations
- Horizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106173 | Path traversal to remote code execution in FortiSIEM 7.5.0 | 9.8 | <1% | PoC ×4 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | horizon3.ai | o 7.5.1 or above) FortiSIEM 7.6 (Not affected) According to Horizon3.ai, the issue involves an unauthenticated attacker connecting |
From the original article
2 min read at thehackernews.com
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-106173 (CVSS score: 9. 4), is a critical path traversal flaw that could allow an unauthenticated attacker to execute unauthorized code or commands via specially
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.