Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit That Requires No Login

A public proof-of-concept exploit has been released for CVE-2026-106173, a critical vulnerability in Fortinet FortiSIEM that can let a remote attacker write files and run code without logging in.

The flaw affects FortiSIEM 7.5.0. Fortinet released a fix in version 7.5.1, while version 7.6 is not affected, according to published reporting on the advisory.

Fortinet disclosed the vulnerability on October 13, 2026, in its FortiGuard security advisory. Horizon3.ai later published technical research and a proof-of-concept on GitHub.

The research shows how an unauthenticated client can reach a gRPC service on TCP port 27918 and abuse its SendQueryResult method to write attacker-controlled data to the FortiSIEM appliance.

The gRPC service accepts query-result data and builds a file path using values supplied by the client. Horizon3.ai found that the service does not properly check the query ID before adding it to the path. By using directory-traversal sequences, an attacker can direct the file write outside the expected query-results folder.

The service also adds its own text to the end of the filename. But Horizon3.ai found that a null byte in a crafted field can cause the operating system to treat the path as ending early.

Fortinet FortiSIEM RCE Vulnerability

This can let an attacker target an exact existing filename instead of being limited to the service’s generated filename. The research says sending the specially formed request requires manually building the gRPC message because common tools and libraries restrict null bytes in headers.

The file-write flaw can become remote code execution if an attacker overwrites a script that the appliance runs automatically. Horizon3.ai identified /opt/charting/redishb.sh, a script it says is run by a scheduled job, as a file of interest.

The researchers also named /opt/phoenix/bin/phLicenseTool as a file administrators should inspect. The published proof-of-concept demonstrates the risk, but its release alone does not show that a particular FortiSIEM system has been compromised.

Administrators should check whether their FortiSIEM appliances run version 7.5.0 and upgrade to 7.5.1 or later. FortiSIEM 7.6 is reported as not affected. If an immediate upgrade is not possible, restrict access to TCP port 27918 to trusted systems and keep it unreachable from the public internet.

Horizon3.ai says it did not find application logs that clearly identify exploitation of this flaw. Teams investigating possible compromise should review file modification times and inspect the named scripts for unexpected changes. A mismatch with nearby system-file timestamps may warrant closer investigation. However, it is not proof of exploitation on its own.

The issue adds to a history of FortiSIEM vulnerabilities reported by Horizon3.ai, including CVE-2024-23108 and CVE-2025-64155. Earlier flaws involved the phMonitor service, while CVE-2026-106173 involves a separate gRPC service. That difference matters for defenders because reviewing protections around one FortiSIEM service does not automatically secure another.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Fortinet FortiSIEM RCE Vulnerability Gets Public Exploit That Requires No Login appeared first on Cyber Security News.