Security researchers at Horizon3.ai on Monday published a working proof-of-concept exploit for a critical FortiSIEM vulnerability that lets an unauthenticated attacker run code remotely on affected appliances.
The flaw, tracked as CVE-2026-106173, is a path traversal issue that Fortinet rated critical (CVSS 9.4) and patched on October 13 in advisory FG-IR-26-180. It affects FortiSIEM 7.5.0, and Fortinet fixed it in 7.5.1. Several vulnerability databases, including NVD, score the bug slightly higher at 9.8.
The vulnerability lives in phQueryMaster, a FortiSIEM component that exposes a gRPC service on TCP port 27918. Horizon3 found that the service accepts connections without requiring a client certificate, so any remote client can reach it unauthenticated. That service is typically intended for internal node-to-node query traffic, not for the open internet.
From there, the problem is how the service handles a remote procedure call named SendQueryResult. The handler builds a file path by pasting an attacker-supplied query-id value straight into a directory string with no validation, so a query-id of ../../../../../tmp/x walks the write out of the intended /query/result/ folder and into any directory the attacker chooses.
The server still appends its own result-…-.dat ending to the filename, which would normally stop an attacker from overwriting a specific file. Horizon3 defeated that by embedding a null byte in the query-id: when the operating system opens the path, it treats the null byte as the end of the string and discards everything after it, including the server’s suffix. The write lands on the exact file the attacker named, overwriting it in place while keeping its original owner and permissions.
To turn that file write into code execution, Horizon3 overwrote /opt/charting/redishb.sh, a Redis health-check script that FortiSIEM runs through a cron job every 60 seconds. Replacing it with attacker-controlled commands gives execution the next time the cron job fires.
“The FortiSIEM gRPC QueryResultReq handler processes untrusted metadata without proper path validation,” Horizon3 said in its analysis.
The exploit chain is the latest in a long line of FortiSIEM flaws from the same team. Horizon3 researcher Zach Hanley, who authored the deep-dive, has previously disclosed CVE-2023-34992, CVE-2024-23108, and January’s CVE-2025-64155 — the last of which drew in-the-wild exploitation attempts within days of disclosure. Fortinet credits its own product security team member, Gwendal Guégniaud, with the internal discovery of this one.
Fortinet says the flaw is not known to be exploited, and it has not been added to CISA’s Known Exploited Vulnerabilities catalog. That calculus changes now that functional exploit code is public: FortiSIEM is the monitoring layer organizations rely on to detect attacks, and a compromise there costs defenders visibility while giving an attacker a foothold in the security infrastructure.
Administrators running FortiSIEM 7.5.0 should upgrade to 7.5.1 or later. FortiSIEM 7.6 and FortiSIEM Cloud are not affected. When patching cannot happen immediately, Fortinet’s recommended workaround is to restrict access to TCP port 27918; the port should never be reachable from the internet in the first place.
Detecting exploitation is difficult. Horizon3 found no application logs that record the attack, and recommends inspecting the write and modification timestamps on /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool for files that don’t match the timestamps around them.
Community Discussion
Join the conversation. Ask questions, share solutions, and help others.
Be the first to start the discussion!
