A severe remote code execution (RCE) flaw in Fortinet’s FortiSIEM has been publicly exploited—and it doesn’t require any credentials. The vulnerability, tracked as CVE-2026-106173, was disclosed October 13, 2026, and affects FortiSIEM version 7.5.0. A proof-of-concept (PoC) exploit has been released showing that attackers can write files and execute code without logging in. Version 7.5.1 patches the issue, while FortiSIEM 7.6 is not vulnerable.
The Mechanics of the Attack
The vulnerability hinges on an insecure gRPC service listening on TCP port 27918. An unauthenticated attacker can call the SendQueryResult method and force the software to write attacker-controlled data. Fortinet’s implementation fails to properly validate the “query ID” before using it to construct a file path, paving the way for directory traversal attacks.
In addition, the service’s filename builder appends its own text to file names, but researchers found they can inject a null byte into certain fields. This effectively allows the attacker to terminate the file name early and target arbitrary existing files. Specifically, two scripts—/opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool—are flagged as high-risk files that attackers could overwrite to gain execution.
What Organizations Should Do Now
Administrators using FortiSIEM 7.5.0 should upgrade immediately to version 7.5.1. If that’s not feasible, it’s essential to isolate TCP port 27918 so only trusted hosts can access it, and prevent exposure to the public internet. FortiSIEM 7.6 and later are not affected, so assessing versioning is critical.
For systems already in place, defenders should review file timestamps and verify contents of the identified scripts to see if they have been modified unexpectedly. While exploitation leaves no obvious logs, unusual changes in system files could signal an intrusion.
This vulnerability isn’t an isolated case. Earlier FortiSIEM flaws, including CVE-2024-23108 and CVE-2025-64155, were found in the phMonitor service. CVE-2026-106173, however, strikes at a different service—making it essential for defenders to cover all attack vectors, rather than assume protections for one component apply to the rest.
Time is of the essence. Because this exploit requires no authentication, any exposed FortiSIEM 7.5.0 instance accessible via TCP 27918 risks compromise. Ensuring quick upgrades, tight network segmentation, and ongoing integrity checks are the best defenses.
What this development means:The emergence of an exploitable bug in a monitoring tool like FortiSIEM highlights how privileged internal infrastructure—which attackers often consider harder to breach—can become a vector. This underscores the growing importance of assuming that internal tools are targets, enforcing strict network access controls, and treating even small version bumps as critical. Going forward, defenders must pace patching pipelines faster, maintain visibility into all inter-service paths, and stay alert for proofs-of-concept that make weaponization easier.
