Fortinet FortiSIEM: Path traversal leads to unauthenticated remote code execution

Summary

A path traversal flaw in the gRPC service phQueryMaster of Fortinet FortiSIEM allows an unauthenticated attacker to write arbitrary files by sending specially crafted packets. Writing files can lead to execution of unauthorized code or commands on the appliance. Fortinet names FortiSIEM 7.5.0 as affected and rates the flaw 9.4, while the CVE record rates it 9.8. Exploitation requires network access to TCP port 27918.

Affected

• FortiSIEM 7.5.0 (per Fortinet advisory FG-IR-26-180)
• FortiSIEM 7.6 and FortiSIEM Cloud: not affected
• The CVE record also lists 7.0.0 to 7.4.2; Fortinet's advisory does not confirm these. Check every FortiSIEM branch you run.

Fixed in

• FortiSIEM 7.5: upgrade to 7.5.1 or later (per Fortinet advisory)
• Other branches: Unknown. The CVE record's solution text names 7.6.0 or later, which conflicts with the vendor advisory.

Workaround

• Restrict access to TCP port 27918 from untrusted networks (vendor workaround)
• The workaround blocks the network path to the vulnerable service but does not fix the flaw

Exploitation

• A public proof-of-concept exploit was published by Horizon3.ai on GitHub
• Fortinet lists Known Exploited as No; the flaw is not listed in CISA KEV (catalog 2026.10.16)
• One outlet reports exploitation in the wild, citing a Canadian advisory; this is not verified
• Horizon3 found no definitive logs of exploitation

Our recommendation

• Upgrade FortiSIEM 7.5.0 to 7.5.1 or later as soon as possible
• Inventory all FortiSIEM versions and block TCP 27918 from untrusted networks now, including NAT rules
• If the system was exposed while unpatched, check the modification times and contents of /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool and consider incident response

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (5 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  horizon3ai/CVE-2026-106173 · 0xBlackash/CVE-2026-106173 · tc4dy/CVE-2026-106173-PoC-Exploit · MRdark-ops/rce-FortiSIEM · aduli198/CVE-2026-106173

Research sources

• Fortinet PSIRT FG-IR-26-180 fortiguard.fortinet.com
• Horizon3.ai proof-of-concept repository github.com
• Horizon3.ai deep-dive analysis horizon3.ai
• Ostorlab analysis blog.ostorlab.co
• ThreatWire report www.threatwire.tech
• Strix CVE details www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:02.