// AI threat desk · 21 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalCVECVSS 9.4

FortiSIEM flaw CVE-2026-106173 could enable arbitrary file writes

Researchers published proof-of-concept code for Fortinet FortiSIEM CVE-2026-106173. The Hacker News gave the flaw a 9.4 CVSS score, while BleepingComputer reported attacks.

· 2 min read
AI-generated image of a security analyst reviewing blurred cybersecurity dashboards in a monitoring centre.
AI-generated image, not a photo of the event.
Key takeaways
  • The Hacker News described CVE-2026-106173 as a critical FortiSIEM flaw with a CVSS score of 9.4.
  • The flaw allows arbitrary file writes through a gRPC service reachable by remote unauthenticated clients on TCP port 27918.
  • BleepingComputer reported that the vulnerability, which has publicly available proof-of-concept exploit code, is being abused in attacks.

Fortinet FortiSIEM users face a critical vulnerability for which researchers have published proof-of-concept exploit code. The Hacker News said CVE-2026-106173 has a CVSS score of 9.4, while BleepingComputer reported that the flaw is being abused in attacks.

The flaw allows arbitrary file writes through a gRPC service. The service listens on TCP port 27918 and accepts remote unauthenticated connections without client certificates, allowing a remote client to reach it.

Fortinet is an American cybersecurity company headquartered in Sunnyvale, California, and develops and sells security products including firewalls, endpoint security and intrusion detection systems. Fortinet published a security advisory on 13 October 2026, and Horizon3.ai published its report on Oct 20, 2026.

On this page

Horizon3.ai describes an unauthenticated gRPC file overwrite

Horizon3.ai said an unauthenticated attacker can connect to the gRPC service on TCP port 27918 and overwrite an existing file outside its intended directory.

Horizon3.ai said that by crafting metadata containing both path traversal sequences and NUL-byte injection within gRPC’s HTTP/2 and HPACK encoding layers, an attacker can write arbitrary files to the file system.

The proof of concept's execution is blind and can take up to 60 seconds for the cron job to run the script it overwrote. Horizon3.ai said the script is invoked every 60 seconds by a cron job.

Fortinet’s FortiSIEM 7.5.0 requires an upgrade

The Hacker News said Fortinet released patches for FortiSIEM 7.5.0, with an upgrade to 7.5.1 or above required. It described the flaw as a path traversal issue that could let an unauthenticated attacker execute unauthorized code or commands through specially crafted packets.

Fortinet’s advisory describes the issue as an arbitrary file write in the gRPC phQueryMaster component. Its workaround says restricting access on TCP port 27918 prevents the issue.

Fortinet’s advisory recommends restricting access to TCP port 27918 as a workaround. FortiSIEM Cloud is not affected, according to the advisory.

Horizon3.ai said it did not find application logs that would explicitly reveal whether the vulnerability had been exploited. The researchers linked the issue to earlier FortiSIEM disclosures involving CVE-2023-34992, CVE-2024-23108 and CVE-2025-64155.

FAQ

What is CVE-2026-106173?

The Hacker News described it as a critical FortiSIEM vulnerability with a CVSS score of 9.4. Horizon3.ai said the flaw allows arbitrary file writes by abusing a gRPC service.

Is FortiSIEM CVE-2026-106173 being exploited?

BleepingComputer reported that the vulnerability is being abused in attacks. Horizon3.ai said it did not find application logs that would explicitly reveal exploitation.

Which FortiSIEM versions need an upgrade for CVE-2026-106173?

The Hacker News said Fortinet released patches for FortiSIEM 7.5.0 and requires an upgrade to 7.5.1 or above.

How can organizations work around the FortiSIEM flaw?

Fortinet recommends restricting access to TCP port 27918 as a workaround. FortiSIEM Cloud is not affected.

How does the FortiSIEM proof of concept work?

Horizon3.ai said an attacker can craft metadata containing path traversal sequences and NUL-byte injection within gRPC’s HTTP/2 and HPACK encoding layers to write arbitrary files.

Sources

  1. GitHub - horizon3ai/CVE-2026-106173: Proof of concept exploit for CVE-2026-106173, a path traversal file write leading to RCE for Fortinet FortiSIEM, GitHubPrimary
  2. CVE-2026-106173: FortiSIEM gRPC Path Traversal to RCE, Horizon3.aiPrimary
  3. PSIRT | FortiGuard Labs, FortinetPrimary
  4. Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution, The Hacker News
  5. Hackers now exploiting critical Fortinet FortiSIEM flaw in attacks, BleepingComputer
  6. More Problems for Fortinet: Critical FortiSIEM Flaw Exploited, Dark Reading
  7. Fortinet, Wikipedia
How we checked this story
ClaimSourceStatus
The Hacker News said the FortiSIEM flaw could result in arbitrary code execution.The Hacker NewsAttributed
The Hacker News said the vulnerability is CVE-2026-106173 and has a CVSS score of 9.4.The Hacker NewsAttributed
The Hacker News said the path traversal flaw could let an unauthenticated attacker execute unauthorized code or commands through specially crafted packets.The Hacker NewsAttributed
The Hacker News said fortinet released patches last week for FortiSIEM 7.5.0, requiring an upgrade to 7.5.1 or above.The Hacker NewsAttributed
Horizon3.ai said an unauthenticated attacker can connect to TCP port 27918 and exploit the flaw to overwrite a file outside its intended directory.Horizon3.ai, via The Hacker NewsAttributed
The vulnerability allows arbitrary file writes by abusing a gRPC service.Horizon3.aiConfirmed
The vulnerable gRPC service listens on TCP port 27918 and accepts remote unauthenticated connections without client certificates.Horizon3.aiConfirmed
Horizon3.ai reported that the flaw had no application logs explicitly revealing exploitation.Horizon3.aiConfirmed
The proof of concept’s execution is blind and can take up to 60 seconds for the overwritten cron script to run.Horizon3.ai, via GitHubConfirmed
Horizon3.ai linked the FortiSIEM research to earlier CVE-2023-34992, CVE-2024-23108 and CVE-2025-64155 disclosures.Horizon3.aiConfirmed
Fortinet’s advisory describes the issue as arbitrary file write in the gRPC phQueryMaster component.FortinetConfirmed
Fortinet recommends restricting access to TCP port 27918 as a workaround.FortinetConfirmed
Fortinet said FortiSIEM Cloud is not affected.FortinetConfirmed
Dark Reading reported that the FortiSIEM vulnerability had come under attack.Dark ReadingAttributed
Fortinet is an American cybersecurity company headquartered in Sunnyvale, California.WikipediaConfirmed
Fortinet develops and sells firewalls, endpoint security and intrusion detection systems.WikipediaConfirmed
horizon3.ai published its report on Oct 20, 2026.horizon3.aiConfirmed

Could not verify

  • Whether the reported attacks exploited CVE-2026-106173 is not established by the primary research.
  • How many FortiSIEM installations were affected is not established.
  • Whether Fortinet assigned additional affected versions beyond the stated upgrade path is not established.
  • Whether attackers successfully achieved code execution in customer environments is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok