Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

Public PoC turns FortiSIEM file-write flaw into unauthenticated RCE

Original title: Critical Fortinet FortiSIEM RCE Vulnerability Gets Public PoC Exploit, Allowing Unauthenticated Attacks

GBHackersby Divya ()2 min read3 · 2 reads
Read at gbhackers.com
AI summary · x-ai/grok-4.7Summaries by Vani AI

Horizon3.ai's GitHub PoC targets FortiSIEM 7.5.0 over TCP 27918; Fortinet advises 7.5.1 or later.

Horizon3.ai published a proof-of-concept exploit for CVE-2026-106173, a critical Fortinet FortiSIEM flaw that lets unauthenticated attackers turn arbitrary file writes into remote code execution. Researcher Zach Hanley said the gRPC service phQueryMaster on TCP port 27918 accepts streamed file content without client certificates and does not adequately validate paths. A null byte in metadata can make writes hit a chosen filename, including the cron-run script /opt/charting/redishb.sh. The report identifies version 7.5.0 as affected and recommends 7.5.1 or later under advisory FG-IR-26-180. Horizon3.ai said public availability does not confirm exploitation in the wild.

Unconfirmed: Horizon3.ai reported no application logs that explicitly indicate exploitation in the wild.

Key facts
  • The gRPC service binds across interfaces and does not require client certificates.
  • The PoC overwrites /opt/charting/redishb.sh, executed every 60 seconds by cron.
  • Investigators are told to check that script and /opt/phoenix/bin/phLicenseTool.
  • Fortinet's advisory is FG-IR-26-180, issued October 13; the analysis followed on October 20.
Security assessment · AI, from the articlePublic proof of concept

Impact: Unauthenticated remote code execution via arbitrary file write

ProductAffectedFixed in
Fortinet FortiSIEM7.5.07.5.1 or later
What to do
  1. 1.Upgrade affected FortiSIEM systems to 7.5.1 or later.
  2. 2.Restrict network access to the vulnerable gRPC service while patching.
  3. 3.Check modification times of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool.
Analyze CVE-2026-106173 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-106173
ATT&CK
T1190 Exploit Public-Facing ApplicationT1053.003 Cron
Tags
fortisiemfortinetremote-code-executionproof-of-conceptgrpc
Vendors
Fortinet
Products
FortiSIEM
Organizations
Horizon3.ai

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-106173
Path traversal to remote code execution in FortiSIEM 7.5.0
9.8<1%PoC ×4

From the original article

2 min read at gbhackers.com

Horizon3. ai has released a public proof-of-concept exploit for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM. This vulnerability allows unauthenticated attackers to turn arbitrary file writes into remote code execution.

GBHackers

By Divya · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.