Public PoC exploit for critical FortiSIEM vulnerability enables unauthenticated remote code execution

Researchers at Horizon3.ai have released a working PoC exploit for the critical vulnerability CVE-2026-106173 in Fortinet FortiSIEM. This path traversal vulnerability (directory traversal) with a CVSS score of 9.4 allows an unauthenticated attacker to write arbitrary files to the file system and achieve remote code execution. The vulnerable gRPC service is exposed on TCP port 27918 without authentication and without a client certificate, and the availability of a public exploit makes updating an urgent task for all organizations using FortiSIEM. We have already covered this vulnerability when Fortinet published its advisory — now the situation has escalated due to the emergence of a ready-made attack tool.

Exploitation mechanism

According to the technical deep dive by Horizon3.ai, the vulnerability resides in the QueryResultReq handler of the gRPC service. The SendQueryResult() function accepts a user-controlled query-id parameter and uses it to construct a file path without proper validation. The attack combines two techniques:

• Directory traversal — sequences of ../ in the query-id parameter allow the attacker to break out of the target directory and write data to an arbitrary location in the file system.
• Null byte injection — a \0 character embedded in query-id causes the operating system to interpret it as the end of the string. This truncates the file name suffix that the program appends automatically (format result-<IP>-0-0-<id>.dat) and gives the attacker full control over the name of the file being written.

According to Horizon3.ai, when an existing file is overwritten, its original permissions and owner are preserved. This is critically important for turning file writes into code execution: an attacker can overwrite the /opt/charting/redishb.sh script — a Redis health-check shell script that is run every 60 seconds via cron. As a result, malicious code will be executed within a minute after the file is written.

Impacted versions

According to the CNA record, the vulnerability affects a much broader range of versions than some news sources indicate:

• FortiSIEM 7.5.0
• FortiSIEM 7.4.0 – 7.4.2
• FortiSIEM 7.3.0 – 7.3.5
• FortiSIEM 7.2.0 – 7.2.7
• FortiSIEM 7.1.0 – 7.1.9
• FortiSIEM 7.0.0 – 7.0.4

Important: the original news item mentions only version 7.5.0 with a recommendation to update to 7.5.1, but the CNA record contains an expanded matrix of affected versions. It is recommended to consult the official Fortinet advisory FG-IR-26-180 for full information on available fixes for each branch.

Exploitation status and detection

At the time of publication, a public PoC exploit is available, but no confirmed cases of exploitation in real-world attacks have been recorded. According to Horizon3.ai, FortiSIEM application logs do not contain clear traces of exploitation for this vulnerability, which makes detecting attacks with standard monitoring tools difficult.

To check for possible compromise, Horizon3.ai recommends paying attention to the following files:

• /opt/charting/redishb.sh — Redis health-check script executed via cron
• /opt/phoenix/bin/phLicenseTool

You should check the modification timestamps of these files and compare their contents with baseline copies. Changes to the contents or modification dates without a legitimate update may indicate a compromise.

Recommendations

Given the availability of a public exploit and the lack of authentication on the vulnerable service, the update priority is maximum, especially for FortiSIEM deployments where TCP port 27918 is exposed externally:

1. Update FortiSIEM to a fixed version in accordance with advisory FG-IR-26-180. For the 7.5.x branch, update to version 7.5.1 or later.
2. Restrict network access to TCP/27918 using firewall rules. This port must not be accessible from untrusted networks.
3. Verify the integrity of the /opt/charting/redishb.sh and /opt/phoenix/bin/phLicenseTool files for unauthorized changes.
4. Audit network connections to port 27918 in your network equipment logs for the period prior to installing the patch.

This vulnerability is part of a series of critical issues in Fortinet products discovered in October 2026. Earlier we covered the authentication bypass in FortiSandbox (CVSS 9.6) and SQL injection vulnerabilities in FortiAnalyzer and FortiManager. Organizations using Fortinet products should carry out a comprehensive review of the installed versions across the entire product line and ensure that all current security advisories have been applied.