Public exploit released for unauthenticated FortiSIEM RCE (CVE-2026-106173)
Original title: Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit That Requires No Login
Horizon3.ai’s proof of concept writes files via unauthenticated gRPC on port 27918; 7.5.1 fixes 7.5.0, and 7.6 is unaffected.
Horizon3.ai published research and a GitHub proof of concept for CVE-2026-106173 after Fortinet disclosed it on October 13, 2026. An unauthenticated client can reach a gRPC service on TCP port 27918 and abuse SendQueryResult to write files through directory traversal and a null-byte path trick. Overwriting a scheduled script such as /opt/charting/redishb.sh can turn the write into code execution. Fortinet fixed FortiSIEM 7.5.0 in 7.5.1; 7.6 is not affected.
Unconfirmed: Publication of the proof of concept does not show that any particular FortiSIEM system was compromised.
- The gRPC service builds a file path from a client-supplied query ID without a proper check.
- A null byte can make the operating system stop the path before the service’s added text.
- Horizon3.ai also named /opt/phoenix/bin/phLicenseTool for administrator inspection.
- The researchers found no application logs that clearly identify exploitation of this flaw.
Impact: Unauthenticated remote file write that can become code execution
| Product | Affected | Fixed in |
|---|---|---|
| Fortinet FortiSIEM | 7.5.0 | 7.5.1 |
- 1.Upgrade FortiSIEM 7.5.0 to 7.5.1 or later.
- 2.If upgrading immediately is impossible, restrict TCP port 27918 to trusted systems.
- 3.Review modification times and inspect /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool.
- CVEs
- CVE-2026-106173
- Vendors
- Fortinet
- Products
- FortiSIEM
- Organizations
- Horizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106173 | Path traversal to remote code execution in FortiSIEM 7.5.0 | 9.8 | <1% | PoC ×4 |
From the original article
2 min read at cybersecuritynews.com
A public proof-of-concept exploit has been released for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM that can let a remote attacker write files and run code without logging in. The flaw affects FortiSIEM 7. 5.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.