FortiSIEM Exploit Code Released for Critical Unauthenticated RCE Flaw (CVE-2026-106173)

On October 20, Horizon3.ai published an analysis and proof-of-concept exploit code for CVE-2026-106173 in FortiSIEM. The flaw lets an unauthenticated attacker execute code on a vulnerable system. The news is the public demonstration of how the attack works. Fortinet had already released a patch.

What the researchers found

The issue affects a gRPC service that listens on TCP port 27918. Because the service doesn’t validate file paths properly, an attacker can write files outside the intended directory. The researchers showed how to use that file write to overwrite a file the system executes, which gives them remote code execution.

The Hacker News also reported on the Horizon3.ai analysis. Public proof-of-concept code makes the attack easier to reproduce, so administrators should double-check that the patch has been applied. However, public exploit code doesn’t mean the flaw is already being used against organizations.

Which deployments to check

According to the update notes, FortiSIEM 7.5.0 must be upgraded to version 7.5.1 or later. The 7.6 branch is listed as not affected. Don’t assume this applies to every older release without checking Fortinet’s documentation.

FortiSIEM is a security information and event management (SIEM) platform, so administrators should also review how the server connects to the rest of the infrastructure. Whether other network segments can reach the vulnerable service matters even when the appliance has no public IP address.

What to do now

The following steps are defensive recommendations from our editorial team:

• Confirm the version of every FortiSIEM server and check whether Fortinet’s advisory covers it.
• Upgrade the vulnerable 7.5.0 release to 7.5.1 or later, following Fortinet’s documentation.
• Check whether TCP 27918 can be reached from the internet and from internal networks, and allow only the connections that are needed.
• Keep the logs, and look for unexpected file changes, scheduled tasks and processes.
• If you see signs of compromise, start your incident response process. Installing the patch won’t tell you whether attackers were active before it was applied.

SecurHUB’s take

Security tools also need restricted access and timely updates. Penetration testing can show whether administrative services can be reached from parts of the network that shouldn’t have access.

Sources: Horizon3.ai, The Hacker News