Public Exploit Released for Critical FortiSIEM Flaw That Allows Unauthenticated Remote Code Execution

Researchers have released a proof-of-concept exploit for a critical flaw in Fortinet FortiSIEM, a week after Fortinet issued patches. The vulnerability, tracked as CVE-2026-106173, has a CVSS score of 9.4. It is a path traversal weakness that could let an unauthenticated attacker execute unauthorised code or commands by sending specially crafted packets.

According to Horizon3.ai, the problem lies in a gRPC service listening on TCP port 27918. The service handles certain request data without properly checking file paths. This lets an attacker write files outside the folder the software intended, and a second weakness involving a null byte allows them to control which file is overwritten. Horizon3.ai explained that this ability to overwrite an existing file can be turned into remote code execution. In the example described, the targeted file is a health check script for the Redis service that a scheduled job runs every 60 seconds.

Because a working public exploit now exists, the gap between patch release and real-world attacks may be short. Organisations running FortiSIEM should confirm which version they use and apply Fortinet's fixed release promptly. The source article lists the patched versions, but that list was not included in the portion we reviewed, so check Fortinet's advisory for the exact versions.