If you run Fortinet's FortiSIEM 7.5.0, you now have less time to patch. On October 13, Fortinet disclosed and fixed a critical flaw, tracked as CVE-2026-106173, that lets an attacker with no credentials write files to places they shouldn't be able to reach, and potentially run their own code. A week later, on October 20, The Hacker News reported that researchers at Horizon3.ai had released a proof-of-concept showing how the bug can be turned into remote code execution, according to The Hacker News.
Fortinet's advisory still lists the flaw as "Known Exploited: No." Patch windows usually shrink quickly once working exploit details are public, though, and a SIEM is a bad place to find an intruder. It collects logs from across an organization, so a compromise there can undermine visibility everywhere else.
What Fortinet Disclosed
Fortinet's PSIRT advisory, FG-IR-26-180, is titled "Arbitrary file write in grpc phQueryMaster." The underlying weakness is CWE-22, the standard label for path traversal. Path traversal happens when software takes a file location from outside input and fails to keep it inside the directory it is supposed to stay in. An attacker can then step "up and out" of that folder and read or write files elsewhere on the system.
Here, Fortinet says the flaw "may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets." In plain terms, an attacker who can reach the vulnerable service over the network doesn't need a login, and a successful attack can end in code execution on the FortiSIEM appliance.
The affected component is a gRPC service. gRPC is a widely used framework that lets programs call each other's functions over the network. The Hacker News reports that this service listens on TCP port 27918, which is also the port Fortinet's workaround tells customers to lock down.
Fortinet's advisory credits Gwendal Guégniaud of the Fortinet Product Security team with discovering and reporting the bug internally. The advisory also lists "Virtual Patch: No," meaning Fortinet offers no network-layer signature that blocks exploitation of this issue.
Which Versions Are Affected
Per Fortinet's advisory, the scope is narrow, which helps:
- FortiSIEM 7.5.0 is affected. Upgrade to 7.5.1 or above.
- FortiSIEM 7.6 is not affected.
- FortiSIEM Cloud is not affected.
One discrepancy is worth knowing about. The affected-product data in the NVD record, supplied by Fortinet as the CNA, also lists FortiSIEM 7.0.0 through 7.4.2 as affected, while the advisory's version table covers only 7.5 and 7.6. If you run an older branch, confirm your status with Fortinet rather than assuming you are clear. If you're on 7.5.0, act now. If you're on 7.6 or the cloud service, Fortinet says this one doesn't apply to you.
9.4 or 9.8? The Score Depends on Where You Look
Fortinet's own advisory rates the flaw Critical with a CVSSv3 score of 9.4. The NVD record for CVE-2026-106173 lists a CVSS 3.1 score of 9.8 from Fortinet's PSIRT, which is the CVE Numbering Authority (CNA) for its products. The vector is network-reachable, low attack complexity, no privileges and no user interaction required. NVD's own analysis is still "Awaiting Analysis," and the record was last modified October 21.
The gap between the two numbers doesn't change much in practice. Both put the bug well inside "critical," and both describe something an outsider can attack over the network without logging in.
The NVD record also includes an assessment from CISA, added as an Authorized Data Publisher (ADP) using the SSVC (Stakeholder-Specific Vulnerability Categorization) framework. CISA's entry marks exploitation as "poc," meaning a public proof-of-concept exists. It marks the flaw as automatable "yes" and rates technical impact "total." Automatable means an attacker could plausibly script attacks against many targets at once. Total impact means a successful attacker gets full control of the affected component. Defenders should read that combination as a strong reason to move this bug up the queue.
The Public Write-Up
The Hacker News reports that Horizon3.ai's research shows the unauthenticated gRPC service on TCP 27918 can be abused to overwrite a file outside its intended directory, and that this can be chained to code execution. ZeroDayFeed is not linking to or describing the exploit's mechanics.
What matters for defenders is the timeline. A fix shipped on October 13, and public technical detail was reported a week later. That leaves organizations still on 7.5.0 facing a known, documented path to compromise with no virtual patch to fall back on. As of Fortinet's advisory, the company has not marked the flaw as exploited in the wild.
What It Means for Defenders
Who is affected: Any organization running self-managed FortiSIEM 7.5.0, and possibly older branches per the NVD record. FortiSIEM 7.6 and FortiSIEM Cloud are not affected, per Fortinet.
What to do, in order:
- Inventory. Confirm which FortiSIEM version each of your instances runs, including lab, DR and MSSP-managed deployments that are easy to forget.
- Patch. Upgrade FortiSIEM 7.5.0 to 7.5.1 or above. This is Fortinet's fix.
- Restrict TCP port 27918 if you can't patch immediately. Fortinet states that restricting access on TCP port 27918 prevents the issue. Use firewall rules or network segmentation so that only the systems that genuinely need to talk to that port can reach it. It should never be reachable from the internet. Treat this as a stopgap, not a substitute for upgrading.
- Don't rely on IPS. Fortinet lists no virtual patch for this advisory, so a FortiGate IPS signature will not cover you here.
- Look back. Because no login is required and public detail is now available, review the appliance for signs of unexpected file changes or unfamiliar processes. Also check network logs for unexpected connections to port 27918, especially since October 13. If anything looks wrong, treat the SIEM as potentially compromised. Rebuild it from a known-good state and rotate any credentials it stores, such as service accounts and API keys it uses to pull logs from other systems.
For CMMC and federal contractors: A SIEM often sits at the center of your audit-logging and monitoring controls. A compromised log platform undermines the evidence those controls depend on. Document the patch or the compensating port restriction, and the date you applied it, in your vulnerability-management records.
Watch for updates. Fortinet's advisory currently says "Known Exploited: No," and NVD's analysis is pending. If either changes, including any addition to CISA's Known Exploited Vulnerabilities catalog, an already urgent patch becomes an emergency.
