Public PoC Released for Critical FortiSIEM Path Traversal Flaw
Researchers published exploit code for a critical FortiSIEM path traversal bug that could let unauthenticated attackers run code. The flaw is described as recently patched.
Researchers have released a proof-of-concept exploit for a critical FortiSIEM vulnerability that could let an unauthenticated attacker run arbitrary code, The Hacker News reported on Oct. 20, 2026.
The bug is tracked as CVE-2026-106173 and carries a CVSS score of 9.4. Fortinet's advisory describes it as an improper limitation of a pathname to a restricted directory, commonly called path traversal, in FortiSIEM 7.5.0. The vendor says specially crafted packets may allow an attacker to execute unauthorized code or commands.
The flaw is described as recently patched, though the retained source does not detail the fix or confirm which versions received it. Fortinet's advisory lists affected branches from 7.0 through 7.5, with 7.5.0 named in the description.
Why it matters: FortiSIEM sits in the security operations stack, collecting and correlating logs and events. A remotely reachable flaw that needs no credentials is the kind of bug attackers look for once exploit code is public, because it lowers the skill needed to try it.
What defenders should do: check Fortinet's advisory for the affected versions and fixed releases, and treat internet-exposed FortiSIEM instances as a priority. Where patching can't happen right away, reduce exposure and watch for unusual activity. The source gives no evidence of exploitation in the wild.
CVE references
Sources
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code ExecutionPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning