Critical Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit, No Login Required

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-106173, has been publicly disclosed for Fortinet FortiSIEM.
• This flaw allows unauthenticated attackers to write arbitrary files and execute code without needing to log in.
• FortiSIEM version 7.5.0 is specifically affected; Fortinet has released a patch in version 7.5.1, and version 7.6 is not impacted.
• A public proof-of-concept exploit is available, increasing the urgency for immediate patching.

Public Exploit Released for Critical Fortinet FortiSIEM RCE Flaw

A severe vulnerability impacting Fortinet FortiSIEM, identified as CVE-2026-106173, now has a publicly available proof-of-concept (PoC) exploit. This critical security flaw enables a remote, unauthenticated attacker to write arbitrary files to the system and subsequently achieve remote code execution (RCE) without requiring any prior authentication.

The vulnerability specifically targets FortiSIEM version 7.5.0. Fortinet addressed this issue with the release of version 7.5.1, and its FortiSIEM 7.6 release is confirmed to be unaffected by this particular vulnerability.

Fortinet initially announced the vulnerability on October 13, 2026, via its FortiGuard security advisory. Cybersecurity firm Horizon3.ai identified and later published comprehensive technical research and a corresponding PoC exploit on GitHub, detailing the mechanism of the attack.

Technical Deep Dive into CVE-2026-106173

The research reveals that an attacker can interact with a gRPC service running on TCP port 27918 without authentication. By manipulating the SendQueryResult method within this service, an attacker can write attacker-controlled data to the FortiSIEM appliance.

The gRPC service is designed to process query-result data and construct a file path using values supplied by the client. Horizon3.ai’s analysis found that the service fails to adequately validate the query ID before incorporating it into the file path. This oversight allows an attacker to employ directory-traversal sequences, redirecting the file write operation outside its intended query-results directory.

Further complicating matters, the service appends its own text to the end of the filename. However, Horizon3.ai discovered that injecting a null byte into a specially crafted field within the attacker’s input tricks the operating system into prematurely terminating the file path. This technique allows an attacker to target and overwrite a specific, existing filename rather than being restricted to a service-generated name. Exploiting this requires manually constructing the gRPC message, as standard tools and libraries typically restrict null bytes in headers.

The ability to write arbitrary files can be escalated to remote code execution if an attacker overwrites a script that the appliance automatically executes. Horizon3.ai pinpointed /opt/charting/redishb.sh as a script of particular interest, noting that it is routinely run by a scheduled job. Another file administrators should examine is /opt/phoenix/bin/phLicenseTool. While the public PoC demonstrates the risk, its mere presence does not confirm that a specific FortiSIEM system has been compromised.

This vulnerability represents another entry in a series of FortiSIEM flaws reported by Horizon3.ai, including CVE-2024-23108 and CVE-2025-64155. It is crucial for defenders to note that while previous vulnerabilities often involved the phMonitor service, CVE-2026-106173 exploits a distinct gRPC service. This distinction underscores that securing one FortiSIEM service does not automatically extend protection to others.

What You Should Do

• Immediate Patching: Administrators must verify if their FortiSIEM appliances are running version 7.5.0 and immediately upgrade to version 7.5.1 or a later release. FortiSIEM 7.6 is not affected.
• Network Segmentation: If an immediate upgrade is not feasible, restrict access to TCP port 27918, ensuring it is only reachable by trusted systems and remains inaccessible from the public internet.
• Forensic Investigation: Horizon3.ai indicates that application logs may not clearly flag exploitation of this flaw. Security teams should review file modification times for scripts like /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool. Any unexpected changes or discrepancies in timestamps compared to nearby system files warrant a deeper investigation, though this alone is not definitive proof of compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.