Horizon3.ai researchers published a public proof-of-concept exploit on Oct. 20, 2026, for CVE-2026-106173, a critical path traversal vulnerability in Fortinet FortiSIEM that enables unauthenticated attackers to execute arbitrary code or commands.
The flaw carries a CVSS score of 9.4 and involves the FortiSIEM gRPC service on TCP port 27918, where an unauthenticated attacker can overwrite files outside the intended directory. The root cause is in the SendQueryResult() function, which passes a user-supplied query-id parameter directly without sufficient validation. An attacker can embed a null byte in the query-id parameter to terminate the string early, causing the system to ignore the appended file name suffix and overwrite the intended file.
The vulnerability targets a shell script named redishb.sh in the /opt/charting/ directory, which performs health checks on the Redis service and runs every 60 seconds via a cron job. Zach Hanley, Chief Attack Engineer at Horizon3.ai, said, “The write lands on the exact path that preceded the null byte”. Hanley explained that the file-write primitive overwrites an existing file in place while keeping the original owner and permissions, and a second exploit variant uses two requests to create a brand-new file with an exact name.
FortiSIEM automatically appends its own file name, result-<source IP address>-0-0-<id>.dat, where the server controls the id counter, so path traversal alone lets an attacker pick a directory but not a file name. Fortinet released patches for CVE-2026-106173 between Oct. 13 and Oct. 19. The patches cover FortiSIEM version 7.5.0, with an upgrade to 7.5.1 or above advised, and Fortinet confirmed FortiSIEM 7.6 is unaffected.
FortiSIEM instances exposed to the internet are at high risk of exploitation due to the unauthenticated nature of the vulnerability, enabling remote attackers to execute arbitrary code without prior access. Immediate defender actions include network segmentation to isolate FortiSIEM instances and monitoring for suspicious activity while patches are applied.
Join the discussion