FortiSIEM flaw gets public exploit code: what administrators need to know
Researchers have published a proof-of-concept exploit for CVE-2026-106173, a critical Fortinet FortiSIEM vulnerability that can allow unauthenticated remote code execution. The disclosure matters immediately for administrators because the exploit targets a service that can be reached over the network, while Fortinet has already issued a fixed release for the affected branch. Organizations using FortiSIEM 7.5.0 should upgrade to 7.5.1 or later; the supplied advisory says the 7.6 line is not affected.
The flaw is tracked as CVE-2026-106173 and carries a CVSS score of 9.4. It is described as a path-traversal issue in FortiSIEM's gRPC service. An attacker does not need to authenticate before sending specially crafted packets, creating a route from a network request to unauthorized file writes and, ultimately, code execution. The public proof of concept therefore changes the defensive priority: teams should verify which FortiSIEM version is deployed and apply the vendor's stated upgrade before treating the issue as a theoretical defect.
According to the technical description from Horizon3.ai, the relevant service listens on TCP port 27918. The vulnerable request handler accepts metadata containing a query identifier and fails to validate the path adequately. By inserting directory-traversal sequences, an attacker can move the destination outside the intended directory. The exploit also uses a null byte in the query identifier, which causes the operating system to stop interpreting the path before FortiSIEM appends its normal output filename.
That combination is important because the issue is not limited to reading an unintended location. The reported technique can overwrite an existing file while preserving its owner and permissions, and a second variant can create a file with an exact name. The technical example points to a Redis health-check shell script that runs from a cron job every 60 seconds. In practical terms, a successful exploit could turn a file-write primitive into execution through an existing scheduled task, although the evidence does not report exploitation in the wild.
Administrators should first inventory FortiSIEM installations and identify systems still running 7.5.0. Those systems should be upgraded to FortiSIEM 7.5.1 or above, while deployments on 7.6 are identified as not affected by the supplied advisory. The evidence does not provide a separate workaround or a recommended port-blocking rule, so teams should not substitute an unverified mitigation for the documented version change. After upgrading, security teams can review access to the gRPC service and investigate unexpected file changes, but the supplied material does not establish that any particular organization has been compromised.