CVE-2026-106173

CVE-2026-106173 is a path traversal flaw in Fortinet FortiSIEM. Fortinet published it as FG-IR-26-180 on 13 October 2026. The advisory title is "Arbitrary file write in grpc phQueryMaster".

Fortinet says an unauthenticated attacker may execute unauthorized code or commands with specially crafted packets. The weakness is CWE-22. Fortinet rates it Critical and scores it CVSS 3.1 9.4. The full vector is in the CVSS field.

NVD lists a CVSS 3.1 base score of 9.8 under Fortinet's name. The 9.4 in the advisory and the CVE record includes temporal metrics. NVD has not done its own analysis yet ("Awaiting Analysis").

The advisory table lists FortiSIEM 7.5.0 as affected and 7.5.1 as the fix. FortiSIEM 7.6 is not affected. Fortinet says FortiSIEM Cloud is not affected.

The CVE record, also published by Fortinet, goes further. It marks 7.0.0 to 7.4.2 as affected too. Its solution text also says to upgrade to FortiSIEM 7.6.0 or above. The advisory page does not list those older branches. Treat them as at risk until Fortinet clarifies.

Fortinet's workaround is to restrict access to TCP port 27918. Fortinet credits Gwendal Guégniaud of the Fortinet Product Security team, who found it internally.

The CVE is not in the CISA KEV catalog (catalog 2026.10.16). Fortinet's advisory says "Known Exploited: No". ThreatWire found no confirmed exploitation in the wild.

On 20 October 2026, Horizon3.ai published a technical deep-dive and a public PoC repository for this CVE. Horizon3 says the bug allows an unauthenticated file write that leads to remote code execution. ThreatWire read the README only. ThreatWire has not run the PoC. The PoC link field points to it.

See the FortiSIEM CVE-2026-106173 PoC explainer for what to do now.