Fortinet has published security advisory FG-IR-26-180 describing a critical path traversal vulnerability in FortiSIEM, a security information and event management platform. According to the vendor’s advisory, the vulnerability has been assigned a CVSSv3 9.4 score and allows an unauthenticated attacker to execute unauthorized code or commands via specially crafted network packets. Organizations using FortiSIEM should immediately inventory their deployments and assess their exposure to this threat.
Technical details of the vulnerability
The vulnerability is classified as CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (path traversal). The advisory header points to the affected component: gRPC phQueryMaster, and the issue is described as arbitrary file write. This means an attacker can manipulate paths in requests to the gRPC interface to write arbitrary files to the file system of the target server.
Key characteristics of the vulnerability:
- Identifier: FG-IR-26-180 (no CVE identifier assigned at the time the advisory was published)
- CVSSv3 score: 9.4 (critical), assigned by Fortinet; no independent assessment has been found
- Affected product: FortiSIEM
- Attack vector: network, via specially crafted packets
- Authentication: not required
- Potential impact: execution of unauthorized code or commands
The combination of arbitrary file write and the lack of any authentication requirement makes this vulnerability particularly dangerous. An attacker with network access to the phQueryMaster gRPC interface could potentially write a malicious file to a critical directory — for example, replace a configuration file or place executable code — and achieve command execution on the server.
What remains unknown
The current version of the Fortinet advisory contains several significant gaps. The affected FortiSIEM versions are not specified, no fixed releases are named, and no concrete remediation recommendations are provided. There is also no information on whether the vulnerability is being exploited in real-world attacks — its exploitation status remains unknown. The advisory is dated 13 October 2026, and it is likely that further details will be added in subsequent revisions.
Impact assessment
FortiSIEM is an enterprise-class SIEM platform widely used in security operations centers (SOC), by managed security service providers (MSSP), and in large organizations for collecting and correlating security events. Compromising a SIEM system is particularly dangerous: an attacker not only gains a foothold in the infrastructure but also access to aggregated security event data for the entire organization, which can be used to plan further attacks and cover tracks.
The CVSS 9.4 score assigned by Fortinet reflects the high criticality: a remote attack vector, no need for authentication, and the possibility of code execution. We have previously written about critical vulnerabilities in Fortinet products — in particular, about the FortiSandbox vulnerability with CVSS 8.9 and the authentication bypass in FortiMonitorOnSight, which points to a steady stream of critical security issues in the Fortinet ecosystem.
Recommendations
Since Fortinet has not yet published information on affected versions and fixes, the available measures are limited to compensating controls:
- Inventory: identify all FortiSIEM instances in your infrastructure and record their versions
- Restrict network access: ensure that the phQueryMaster gRPC interface is not accessible from untrusted networks. Restrict access to it via network segmentation and firewalls
- Monitoring: strengthen monitoring of network traffic to FortiSIEM servers, paying attention to anomalous gRPC requests and unusual file write operations
- Track updates: regularly check the Fortinet security advisory page for updates to FG-IR-26-180 that specify affected versions and patches
Given the CVSSv3 9.4 score and the possibility of remote code execution without authentication, organizations running FortiSIEM should treat this vulnerability as a priority. The key action right now is to restrict network access to the phQueryMaster gRPC interface to trusted hosts only and prepare for rapid patch deployment as soon as Fortinet publishes information about fixed versions.
