Fortinet FortiSIEM — Critical gRPC Path Traversal and File Write RCE Flaw (CVE-2026-106173)

Publication date: October 20, 2026
Category: Vulnerability / Enterprise Security

Introduction

Security researchers have published a proof-of-concept (PoC) exploit targeting a recently patched critical security flaw affecting the Fortinet FortiSIEM security information and event management platform. Tracked as CVE-2026-106173, this vulnerability allows an unauthenticated remote attacker to achieve arbitrary code execution on vulnerable installations. The public availability of the exploit code significantly escalates operational risk for organizations that have not yet applied the vendor patches.

What is FortiSIEM and the Path Traversal Vulnerability? (General Analysis)

FortiSIEM is an enterprise-grade security information and event management solution engineered to deliver centralized visibility, log correlation, and incident response capabilities across complex infrastructures. Because it typically sits in privileged network positions to monitor organizational security, any compromise of this core component can grant an attacker absolute control over network telemetry and security postures.

The identified vulnerability is officially classified under parameters confirmed by the National Vulnerability Database (NVD):

  • CVE: CVE-2026-106173
  • Official CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — Score: 9.8 (CRITICAL)
  • Official CWE Classification: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
  • CISA KEV: Not reported in the catalog at the time of analysis.

This critical flaw stems from inadequate input validation during metadata handling within the platform’s internal services, enabling an unprivileged remote attacker to manipulate file paths on the underlying operating system.

How Does It Work? (Technical Analysis)

In-depth technical analysis reveals that the attack vector exploits FortiSIEM’s gRPC communication architecture, specifically listening on TCP port 27918.

  • Initial Entry Flow and gRPC Processing: The QueryResultReq handler within the gRPC service processes metadata originating from untrusted sources without performing proper path validation. By crafting requests tailored to gRPC’s HTTP/2 and HPACK encoding layers, an attacker can inject directory traversal sequences (../).
  • Arbitrary File Write Mechanism: The core issue stems from unsafe path construction within the SendQueryResult() function, which processes a user-supplied parameter named query-id. Although the ../ sequences allow escaping the restricted directory, the software automatically appends a default file name suffix structured as result-<source IP address>-0-0-<id>.dat.
  • Evasion via Null-Byte Injection and Persistence: To bypass the automatically generated file name suffix, the exploit introduces a null byte (\0) within the query-id parameter. The operating system interprets this byte as a string terminator, completely discarding any subsequent content. This behavior allows attackers to overwrite pre-existing critical files—such as the Redis health-check shell script redishb.sh, which is executed every 60 minutes via a cron job—thereby achieving arbitrary command execution under the context of the affected service.

Affected Systems / Environments

The flaw directly impacts specific versions of the FortiSIEM infrastructure:

CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2026-106173 CWE-22 Remote Code Execution (RCE) / File Write 9.8 (Critical) AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • FortiSIEM 7.5.0: Vulnerable (requires immediate upgrade to version 7.5.1 or above).
  • FortiSIEM 7.6: Not affected.

Mitigation and Detection

Remediation

Organizations operating FortiSIEM instances must deploy manufacturer-recommended mitigations without delay:

  1. Immediately upgrade FortiSIEM 7.5.0 to version 7.5.1 or higher, where the path validation flaw within the gRPC service has been resolved.
  2. Restrict network access to TCP port 27918 (gRPC service), permitting connections solely from strictly necessary and trusted origins through network segmentation policies.

Detection

Blue Teams must actively monitor network traffic and system logs for anomalies associated with this attack vector.

“The presence of directory traversal sequences combined with null-byte characters within gRPC request metadata targeting port 27918 constitutes an unambiguous indicator of exploitation attempts against FortiSIEM.”

  • Log Monitoring: Audit gRPC service access logs for suspicious patterns in the query-id parameter containing ../ sequences and null-byte (\0) string terminations.
  • File Integrity Monitoring (FIM): Deploy integrity monitoring solutions across critical system directories and scripts executed by scheduled tasks (cron), particularly those linked to auxiliary services like Redis (redishb.sh).

Wrapping Up

The disclosure of a public exploit for critical vulnerability CVE-2026-106173 in FortiSIEM poses a severe operational risk to organizations relying on the platform. By combining a path traversal flaw in the gRPC service with null-byte injection techniques, threat actors can achieve unauthenticated remote code execution. Prioritizing patch deployment and network segmentation remains essential to neutralizing this threat.

References