Fortinet FortiSIEM: Public PoC exploit released for unauthenticated RCE via path traversal and NUL-byte file overwrite (CVE-2026-106173)
Severity: critical · Patch status: patched · Since 2026-10-20 · CVE-2026-106173
Researchers at Horizon3.ai published a proof-of-concept exploit for CVE-2026-106173 (CVSS 9.4), a critical path traversal flaw in Fortinet FortiSIEM allowing unauthenticated remote code execution. The gRPC QueryResultReq handler on TCP port 27918 processes a user-supplied 'query-id' without validation, letting attackers traverse directories and embed a NUL byte to truncate the appended filename and overwrite arbitrary files. The PoC overwrites /opt/charting/redishb.sh, a Redis health-check script run by cron every 60 seconds, converting the arbitrary-file-write into code execution. Fortinet patched the flaw last week: FortiSIEM 7.5.0 users must upgrade to 7.5.1 or above; 7.6 is not affected. With a public PoC available, organisations running affected versions face imminent exploitation risk.
What to do
- Upgrade FortiSIEM 7.5.0 to 7.5.1 or above immediately
- Restrict network access to TCP port 27918 (gRPC service) from untrusted networks
- Check /opt/charting/redishb.sh and similar cron-run scripts for tampering
- Hunt for signs of exploitation, including unexpected writes or cron-executed script modifications
- Monitor Fortinet advisories for additional affected branches
Fixed versions
- FortiSIEM 7.5.1 or above (7.6 not affected)
Sources
All live incidents on Threat Watch
