FORTINET’S FortiSIEM has a newly publicised vulnerability, tracked as CVE-2026-106173, labelled a critical path traversal flaw that allows unauthenticated remote code execution. Fortinet’s advisory puts the CVSS at 9.4 and notes patches were released last week. The issue affects FortiSIEM 7.5.0, with a required upgrade to 7.5.1 or newer; FortiSIEM 7.6 is listed as not affected.
Researchers from Horizon3[.]ai published a proof-of-concept (PoC) showing how an unauthenticated actor can reach the gRPC service on TCP port 27918, overwrite a file outside the intended directory, and convert the arbitrary-file-write primitive into remote code execution.
The exploit’s core weakness lies in unsafe path handling in the gRPC QueryResultReq pathway. By crafting untrusted metadata that includes path traversal sequences (../) and leveraging a null-byte injection in the query-id parameter, an attacker can cause the system to write to a chosen path and potentially replace an existing file or create a new one with a controlled name.
Horizon3[.]ai explains that the mechanism uses a server-controlled file name format, and the null byte terminator causes the final path to omit the suffix, enabling precise targeting of a file to overwrite. Practically, this could enable an attacker to plant or replace scripts or binaries on the FortiSIEM host, underscoring the urgency of upgrading to 7.5.1+ as advised.