Critical FortiSIEM path traversal flaw gains public exploit enabling unauthenticated remote code execution

Fortinet patched CVE-2026-106173, a critical path traversal flaw rated 9.4 in FortiSIEM that lets an unauthenticated attacker execute commands through specially crafted packets, and researchers have now released a public proof of concept. The attacker connects to the gRPC service on TCP port 27918 and writes a file outside the intended directory, using a null byte in the query-id parameter to truncate the filename so the write lands on an existing path such as a Redis health-check script that cron runs every 60 seconds. FortiSIEM 7.5.0 is affected, 7.6 is not, and users should upgrade to 7.5.1 or above. Horizon3.ai published the research.

Check

Upgrade FortiSIEM 7.5.0 to 7.5.1 or above immediately, since a public proof of concept now exists, and restrict access to the gRPC service on port 27918.

Affected

FortiSIEM 7.5.0 lets an unauthenticated attacker write a file outside the intended directory through crafted packets to the gRPC service, achieving remote code execution via a cron-run script.

Fix

Apply the FortiSIEM 7.5.1 upgrade, restrict network access to the management and gRPC services, and review hosts for unexpected changes to cron-run scripts.