Public PoC Released for Critical FortiSIEM Path Traversal RCE
Horizon3.ai published exploit code for an unauthenticated gRPC path traversal in FortiSIEM 7.5.0 that Fortinet rated critical and fixed in 7.5.1.
Security researchers at Horizon3.ai published a working proof-of-concept exploit for a critical FortiSIEM vulnerability that lets an unauthenticated attacker run code on affected appliances, Cyber Kendra reported on Oct 20, 2026.
The flaw is a path traversal issue that Fortinet rated critical at CVSS 9.4 and addressed in advisory FG-IR-26-180. It affects FortiSIEM 7.5.0, and Fortinet fixed it in 7.5.1. The report says several vulnerability databases, including NVD, score the bug slightly higher at 9.8.
According to the write-up, the bug sits in phQueryMaster, a component that exposes a gRPC service on TCP port 27918. Horizon3 found the service accepts connections without requiring a client certificate, so a remote client can reach it unauthenticated. The handler for a remote procedure call named SendQueryResult builds a file path from an attacker-supplied query-id without validation, letting a crafted value write outside the intended results folder. Horizon3 said it used a null byte to strip the server's appended filename suffix and overwrite a chosen file, then replaced a Redis health-check script that FortiSIEM runs on a cron schedule to gain execution.
Fortinet credits its own Gwendal Guégniaud with internal discovery. The report says the flaw is not known to be exploited and is not in CISA's Known Exploited Vulnerabilities catalog.
Why it matters
FortiSIEM is a monitoring layer defenders use to spot attacks. A compromise there costs visibility while giving an intruder a foothold in security infrastructure.
What defenders should do
Administrators on 7.5.0 should upgrade to 7.5.1 or later. The report says FortiSIEM 7.6 and FortiSIEM Cloud are not affected. Where patching must wait, Fortinet's recommended workaround is restricting access to TCP port 27918, which should not be reachable from the internet.
Detection is hard. Horizon3 found no application logs recording the attack and suggests checking write and modification timestamps on /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool for files that don't match their neighbors.
CVE references
Sources
- FortiSIEM RCE Flaw CVE-2026-106173 Gets Public PoCPrimarywww.cyberkendra.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning