Critical FortiSIEM RCE Flaw Receives Public Exploit Code

Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a critical security vulnerability affecting Fortinet FortiSIEM servers, raising urgency for organizations to apply available patches.

Tracked as CVE-2026-106173 and carrying a CVSS severity score of 9.4, the vulnerability is an unauthenticated path traversal flaw. It allows remote attackers to execute arbitrary code or commands through specially crafted packets sent to vulnerable enterprise systems.

According to analysis published by security firm Horizon3.ai, the issue involves an unauthenticated attacker connecting to the gRPC service listening on TCP port 27918. The handler processes untrusted metadata without proper path validation.

By crafting metadata that includes directory traversal sequences alongside a null-byte injection within the gRPC encoding layers, attackers can overwrite arbitrary files on the underlying file system. This path traversal primitive is then leveraged to achieve full remote code execution.

Fortinet released software updates addressing the vulnerability last week. The updates affect FortiSIEM 7.5.0, which requires an immediate upgrade to version 7.5.1 or above. FortiSIEM version 7.6 is not affected by the flaw.

Security teams running vulnerable deployments are urged to apply the vendor patches immediately to mitigate the risk of active exploitation now that functional exploit code is publicly available.