A critical vulnerability in Fortinet’s FortiSIEM has now seen a working exploit disclosed publicly. The flaw, designated CVE-2026-106173 with a CVSS severity score of 9.4, enables unauthenticated remote attackers to execute arbitrary code via specially crafted requests. Patches have already been issued for affected versions.
What the flaw entails
The issue is a path traversal bug in FortiSIEM’s gRPC service, which listens on TCP port 27918. An attacker could exploit it by sending malformed metadata in HTTP/2 frames, using path traversal sequences (such as “../”) in combination with null-byte injections in the metadata fields. Together, these techniques let the attacker write to arbitrary paths on the file system outside of the intended directory.
At the root of the problem is a function called SendQueryResult(), which takes an unsanitized “query-id” parameter provided by the client. Because this parameter isn’t properly validated for invalid characters or directory escape sequences, it enables traversal. Further, appending a null byte (‘\0’) causes the system to truncate execution of the metadata string before the file name suffix that the system usually adds. This allows the attacker to control the actual file name that gets overwritten. One proof-of-concept example uses this technique to overwrite a Redishb health-check shell script—executed as a cron job every minute—via a crafted “query-id”.
Affected versions and patch details
The vulnerability impacts FortiSIEM version 7.5.0 (users should update to 7.5.1 or newer). Version 7.6 is not vulnerable. Fortinet released patches last week to address the issue.
The combination of pre-authentication, remote code execution, and ease of exploitation—via public proof-of-concept code—elevates this from a mere theoretical risk to a serious, present-day threat. Any deployment using FortiSIEM 7.5.0 should assume they are at risk.
What admins should do now
Organisations running FortiSIEM 7.5.0 should immediately upgrade to version 7.5.1 or higher. If upgrading is not yet possible, temporary mitigations could include disabling the vulnerable gRPC service, restricting access to port 27918 via network segmentation or firewall rules, and inspecting logs for unexpected writes or metadata containing “../” or null bytes.
Also, teams should verify that any critical system scripts—especially those run via cron—have not been tampered with, particularly in environments where FortiSIEM and Redis coexist or interact.
With a working exploit now public, threat actors have what they need to probe for vulnerable systems. Organisations should treat this as an urgent security issue.
Given the severity and the public availability of a proof-of-concept exploit, this flaw demands swift action from organisations using FortiSIEM. What to watch for: whether attackers begin targeting known infrastructure, the pace at which Fortinet’s customers deploy patches, and whether this method becomes part of threat actor toolkits.
