Cybersecurity researchers release FortiSIEM exploit

Researchers at Horizon3.ai have published a public Proof of Concept (PoC) exploit for a critical vulnerability in Fortinet’s FortiSIEM product. The flaw, tracked as CVE-2026-106173 with a CVSS score of 9.4, is a path traversal vulnerability.

Unauthenticated attackers can exploit a gRPC service on TCP port 27918 to bypass client certificate requirements. This allows remote actors to traverse outside the query directory, gain arbitrary control, and overwrite periodically executed scripts to remotely execute malicious code or commands.

Fortinet has urged customers using FortiSIEM version 7.5.0 to upgrade to version 7.5.1 or higher. While FortiSIEM 7.6 and FortiSIEM Cloud are unaffected, security teams can mitigate risk by restricting access to TCP port 27918. Because there are no specific application logs to indicate exploitation, researchers suggest inspecting file write or modified timestamps on existing scripts to detect unauthorized changes.