CVE-2026-106173
CVSS 9.8 CRITICAL: a improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM…
Vulnerabilities & Exploits
Horizon3.ai published a public proof of concept showing unauthenticated remote code execution in Fortinet FortiSIEM 7.5.0 through CVE-2026-106173; Fortinet patched the flaw last week in version 7.5.1.
The attack reaches FortiSIEM’s gRPC service, which handles remote procedure calls, and uses path traversal to write outside its intended directory. The service normally adds its own filename to each write, but a hidden string-ending character makes the system stop reading the path early. That lets an attacker target an existing shell script that checks Redis and runs every 60 seconds under cron. Replacing that trusted script turns a file-write flaw into code execution.
For appliances reachable by untrusted networks before the patch, the exposure may persist beyond the vulnerable service: a replaced health-check script can still run on schedule. Updating FortiSIEM may close the entry point without undoing a file already changed on the appliance.
1 source · 6h ago
CVSS 9.8 CRITICAL: a improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM…
The Hacker News
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
Researchers release a PoC for critical FortiSIEM flaw CVE-2026-106173, showing how unauthenticated attackers can achieve remote code execution.
originalPart of the PlainSec briefing for 2026-10-20
Every edition of this story: FortiSIEM PoC turns file overwrite into code execution