FortiSIEM gRPC flaw allows unauthenticated file-write RCE
Original title: CVE-2026-106173 Deep-Dive: FortiSIEM gRPC Path Traversal File Write RCE
phQueryMaster on tcp/27918 accepts any client, and a crafted query id can overwrite a cron-run script.
On October 13, 2026, Fortinet published an advisory for critical FortiSIEM vulnerability CVE-2026-106173. Horizon3.ai says the phQueryMaster gRPC service on tcp/27918 does not require a client certificate and that SendQueryResult builds a file path from an attacker-controlled query id. A null byte in that value lets a remote client overwrite an exact path, including a Redis health-check script that cron runs every 60 seconds, leading to code execution. The provided text does not give affected or fixed versions or say the bug is being exploited.
Unconfirmed: Affected and fixed versions are not in the excerpt, and real-world exploitation is not stated.
- The service binds every interface as [::]:27918 and does not request a client certificate.
- Query-id path concatenation has no input validation, so the write can leave the query directory.
- The filename is otherwise server-generated until a null byte truncates it.
- Overwriting /opt/charting/redishb.sh is the code-execution path described; cron runs it every 60 seconds.
- Earlier Horizon3 FortiSIEM research cited in the post targeted phMonitor on tcp/7900.
Impact: Unauthenticated arbitrary file write leading to remote code execution
| Product | Affected |
|---|---|
| Fortinet FortiSIEM | — |
- 1.Restrict network access to FortiSIEM gRPC on tcp/27918 until the vendor fix is applied.
- CVEs
- CVE-2026-106173
- Vendors
- Fortinet
- Products
- FortiSIEM
- Organizations
- Horizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106173 | Path traversal to remote code execution in FortiSIEM 7.5.0 | 9.8 | <1% | PoC ×4 |
From the original article
4 min read at horizon3.ai
Horizon3 researchers analyze CVE-2026-106173, a critical Fortinet FortiSIEM vulnerability affecting an unauthenticated gRPC service. The deep-dive explains how path traversal and null-byte handling enable arbitrary file writes and remote code execution, along with indicators of compromise for defenders.
By Zach Hanley · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.