Fortinet: four advisories including unauthenticated path traversal RCE in FortiSIEM phQueryMaster (CVE-2026-106173)
Severity: critical · Patch status: unknown · Since 2026-10-13 · CVE-2026-106173, CVE-2026-106174
On 2026-10-13 Fortinet published four PSIRT advisories. The most severe (FG-IR-26-180, CVE-2026-106173, CVSS 9.4) is a path traversal (CWE-22) in FortiSIEM's grpc phQueryMaster allowing an unauthenticated attacker to write arbitrary files and execute unauthorized code via crafted packets, affecting FortiSIEM 7.5 and 7.6. Also disclosed: SQL injection (CWE-89) in FortiMail webmail (CVSS 7.7) allowing authenticated attackers to execute code via crafted HTTP requests; an improper locking flaw (CWE-667, CVE-2026-106174, CVSS 6.7) letting unauthenticated attackers DoS the FortiOS HTTPS management interface (FortiOS 7.6.4-7.6.6 and 8.0.0); and OS command injection (CWE-78, CVSS 5.3) in FortiManager's fgfmd daemon, exploitable only by an attacker impersonating a FortiManager cluster node with its certificate and private key. All were internally discovered or responsibly disclosed; no in-the-wild exploitation is reported. Fixes are available via Fortinet upgrade paths; consult each advisory for exact fixed versions.
What to do
- Upgrade FortiSIEM 7.5/7.6 to a fixed release immediately — unauthenticated pre-auth RCE with CVSS 9.4
- Upgrade FortiMail to a fixed release and review webmail accounts for signs of abuse
- Upgrade affected FortiOS versions (7.6.4-7.6.6, 8.0.0) to restore management-interface availability
- Upgrade FortiManager and verify cluster node certificates/private keys have not been exposed
- Restrict management interface access (FortiOS/FortiManager) to trusted networks as mitigation
Sources
All live incidents on Threat Watch
