Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

FortiSIEM is a security information and event management platform made by Fortinet. It gathers and analyzes information from an organization's computer systems, networks, and security tools. This gives security teams a central view of activity and potential problems. The supplied article does not explain FortiSIEM's product features in detail, so this description uses established industry knowledge.

In this incident, FortiSIEM includes a gRPC service that listens on TCP port 27918. Researchers found that this service could process attacker-controlled metadata unsafely. That matters because the service was reachable without authentication, allowing an attacker to target a monitoring system without first signing in.

Fortinet released patches for the affected FortiSIEM version. The article identifies FortiSIEM 7.5.0 as requiring an upgrade to 7.5.1 or above, while FortiSIEM 7.6 is listed as not affected. A vulnerable monitoring platform can become an entry point for broader compromise, making timely updates important.

The vulnerability is CVE-2026-106173, a critical path traversal flaw in FortiSIEM. It can let an unauthenticated attacker send specially crafted packets that cause unauthorized code or command execution. The problem involves unsafe path construction in the SendQueryResult() function, which uses a user-supplied query-id without enough validation.

Horizon3.ai released a proof-of-concept exploit. Its technique connects to the gRPC service on TCP port 27918 and abuses crafted metadata containing path traversal sequences and a null byte. The attacker can then overwrite an existing file outside the intended directory, turning arbitrary file writing into remote code execution.

The public PoC makes the issue more urgent because it provides a practical demonstration of how to exploit the bug. Fortinet has already released patches. FortiSIEM 7.5.0 should be upgraded to 7.5.1 or later, while the article lists FortiSIEM 7.6 as not affected.

CVSS scores measure the severity of security vulnerabilities on a scale from 0 to 10. A score of 9.4 is considered critical, the highest standard severity category. It indicates that the flaw could have serious consequences and deserves rapid attention. The article gives CVE-2026-106173 a 9.4 score because it can support unauthorized code or command execution.

The article identifies two FortiSIEM version entries. FortiSIEM 7.5.0 is affected and must be upgraded to 7.5.1 or above. FortiSIEM 7.6 is listed as not affected. These are two version lines, with one affected entry and one unaffected entry.

The risk is heightened because the flaw can be exploited without authentication and a proof-of-concept is public. Organizations running 7.5.0 should apply the stated upgrade. They should also review whether exposed systems offer access to the gRPC service on TCP port 27918.

The attack begins when an unauthenticated attacker connects to FortiSIEM's gRPC service on TCP port 27918. The service handles requests without requiring the attacker to sign in. A specially crafted request can therefore reach the vulnerable QueryResultReq handler directly.

The attacker places path traversal sequences such as ../ in the query-id metadata. This makes the service leave its intended directory and write somewhere else. The program normally adds a generated filename, result-<source IP address>-0-0-<id>.dat. A null byte in the query-id causes the operating system to treat the rest of that string as finished, discarding the appended suffix.

This combination lets the attacker target an existing file by placing its exact path before the null byte. Horizon3.ai reported that overwriting a shell script used by a cron job can turn the file-write capability into remote code execution. No login is needed at any stage described.

Path traversal uses sequences such as ../ to move out of an application’s intended directory. Arbitrary file writing means the attacker can cause data to be written to a file location chosen through the attack. Null-byte injection inserts \0 into a string so the operating system treats it as a terminator and ignores everything after it.

In this attack, the query-id parameter carries both traversal sequences and a null byte. The traversal reaches a different directory, but the program normally appends result-<source IP address>-0-0-<id>.dat, limiting the filename choice. The null byte cuts off that suffix when the path reaches the file-opening function.

The combined result is an exact file path before the null byte, such as the Redis health-check script path described by the researchers. Horizon3.ai also reported a second variant that uses two requests to create a new file with an exact name. This turns a directory escape into a powerful file-overwrite primitive.

The Redis health-check script is not just an ordinary file. The article says a cron job runs it every 60 seconds to perform health checks on the Redis service. That scheduled execution creates an automatic opportunity for any commands placed inside the script to run.

An attacker uses the FortiSIEM flaw to overwrite the existing script in place. The path traversal reaches the script, while null-byte injection prevents FortiSIEM from appending its normal result filename. The attacker can therefore replace the script's contents while keeping its original owner and permissions, according to Horizon3.ai.

When cron next launches the altered script, its commands can execute on the FortiSIEM system. This is how an arbitrary-file-write capability becomes remote code execution. The article describes this as the key escalation path, rather than claiming that every overwritten file would automatically produce code execution. A patch is therefore important before the scheduled job runs again.

gRPC is a framework that lets one software service call functions on another service as if they were local operations. It is commonly used for structured, service-to-service communication. HTTP/2 is the network protocol that can carry those calls, supporting efficient, multiplexed exchanges. HPACK is the header-compression method used by HTTP/2.

In this incident, FortiSIEM exposes a gRPC service on TCP port 27918. Horizon3.ai said the attacker can place malicious metadata in gRPC's HTTP/2 and HPACK encoding layers. The QueryResultReq handler then processes that untrusted metadata without proper path validation.

These technologies are used because software systems often need fast, compact, and organized communication between separate services. Their normal purpose is not the vulnerability. The problem is FortiSIEM's handling of attacker-controlled metadata, especially the query-id value. Strong validation is needed whenever service protocols carry data that influences file paths or other sensitive operations.