Public exploit released for unauthenticated FortiSIEM RCE (CVE-2026-106173)
Horizon3.ai’s proof of concept writes files via unauthenticated gRPC on port 27918; 7.5.1 fixes 7.5.0, and 7.6 is unaffected.
Stories per day · 30 days
2 RSS
Relatedfortinet7grpc4remote-code-execution4path-traversal3proof-of-concept2psirt2advisory1broken-authorization1cwe-221cwe-8621fg-ir-26-1831fortianalyzer1fortimail1fortimanager1fortisandbox1poc1rce1sql-injection1
9 stories, newest first · one card per story
Stories tagged #fortisiem
Public PoC turns FortiSIEM file-write flaw into unauthenticated RCE
Horizon3.ai's GitHub PoC targets FortiSIEM 7.5.0 over TCP 27918; Fortinet advises 7.5.1 or later.
Public PoC targets critical FortiSIEM unauthenticated RCE (CVE-2026-106173)
Horizon3.ai shows a gRPC path traversal on port 27918 that overwrites a cron-run Redis health script.
FortiSIEM gRPC flaw allows unauthenticated file-write RCE
phQueryMaster on tcp/27918 accepts any client, and a crafted query id can overwrite a cron-run script.
Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
Arbitrary file write in grpc phQueryMaster
Fortinet warns of a CVSS 9.4 FortiSIEM path traversal letting unauthenticated attackers run commands.
Fortinet security advisory (AV26-023) - Update 1
CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.
2
Open Redirect on FortiSIEM
Fortinet disclosed an open redirect flaw (CVSS 2.8) in FortiSIEM allowing authenticated attackers to redirect users to arbitrary websites via crafted HTTP requests.
Server-Side Request Forgery (SSRF)
Fortinet discloses a low-severity SSRF in the FortiSIEM GUI allowing authenticated attackers to send requests from targeted devices.