Attackers exploit FortiSIEM flaw after public PoC release

Fortinet’s FortiSIEM has a critical vulnerability, CVE-2026-106173, which is being exploited in the wild following a public proof-of-concept exploit and open disclosures. The Canadian Cyber Centre’s advisory AV26-1037 notes active exploitation, and Horizon3 has published a full technical write-up with a public PoC on GitHub; the CVE record has been enriched by CISA, which regards the flaw as automatable.

Fortinet’s own PSIRT FG-IR-26-180 states that FortiSIEM 7.5.0 is affected and that 7.5.1 is fixed, with FortiSIEM 7.6 and FortiSIEM Cloud not affected. The vulnerability is rated CVSS 9.4 in public disclosures and has an exploit maturity of E:H in Fortinet’s advisory, indicating functional exploit code exists.

The issue resides in the gRPC service of the phQueryMaster daemon, where metadata handling lacks proper path validation, enabling an unauthenticated attacker to write files outside the intended directory and ultimately achieve code execution. Horizon3 notes that there are no obvious application logs signalling the attack, making detection reliant on unusual file timestamps. FortiSIEM versions affected include 7.5.0, with 7.5.1 as the fix; older branches from 7.0.0 through 7.4.2 are also listed in the CVE record.

Fortinet recommends upgrading to FortiSIEM 7.5.1 or later, restricting TCP port 27918, and auditing scheduled scripts for unexpected file changes; given the active exploitation, admins are urged to patch promptly.