FORTISIEM has a critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-106173. A technical deep dive by Horizon3 detailed a gRPC path traversal flaw that enables an unauthenticated attacker to write files and execute code. The PoC exploit and full analysis were made public, with Horizon3 noting that the gRPC service listens on TCP port 27918 and accepts connections without a client certificate.
By constructing a manipulated file path from attacker-supplied values, an adversary can overwrite a script used by a scheduled task, allowing code execution in the administrator’s context. The vulnerability is described as an improper limitation of a pathname to a restricted directory (path traversal). Fortinet patched the flaw in advisory FG-IR-26-180 on 13 October 2026.
FortiSIEM versions affected include 7.5.0; 7.4.0 through 7.4.2; 7.3.0 through 7.3.5; 7.2.0 through 7.2.7; 7.1.0 through 7.1.9; and 7.0.0 through 7.0.4. The CVSS v3 score is listed as 9.8 (Critical). At present there is no confirmed exploitation in the wild, and CISA enrichment marks the record status as “poc” with exploitation potential. Mitigations focus on upgrading to fixed releases, blocking unauthorised access to TCP port 27918, and monitoring for unexpected changes to scheduled scripts and their timestamps.
Admins should apply Fortinet’s patch promptly, given the public PoC and the high severity. There is no indication of active exploitation in logs, but the availability of a PoC increases the likelihood of emergence in the wild.