FortiSIEM CVE-2026-106173: Horizon3 releases public PoC

What happened

On 13 October 2026, Fortinet published advisory FG-IR-26-180. It fixes CVE-2026-106173, a path traversal flaw in FortiSIEM. Fortinet says an unauthenticated attacker may run code or commands with specially crafted packets.

On 20 October 2026, the security firm Horizon3.ai published a technical deep-dive and a public PoC repository on GitHub. Horizon3 says the bug gives an unauthenticated file write that leads to remote code execution. ThreatWire read the README only. ThreatWire has not run the PoC.

Who is affected

The Fortinet advisory lists FortiSIEM 7.5.0 as affected. The fix is FortiSIEM 7.5.1 or above. FortiSIEM 7.6 is not affected. Fortinet says FortiSIEM Cloud is not affected.

The CVE record, also published by Fortinet, lists a wider range. It marks 7.0.0 to 7.4.2 as affected too. Its solution text adds "upgrade to FortiSIEM 7.6.0 or above". The advisory page does not mention those branches. Fortinet has not explained the gap.

The flaw sits in the phQueryMaster gRPC service on TCP port 27918. Fortinet's workaround is to restrict access to that port.

What is confirmed

• Advisory. Fortinet rates the flaw Critical. It scores it CVSS 3.1 9.4. The attack type is unauthenticated. The weakness is CWE-22.
• NVD. NVD shows a base score of 9.8 under Fortinet's name. Fortinet's 9.4 includes temporal metrics. NVD has not done its own analysis yet.
• Credit. Fortinet found the bug internally. It credits Gwendal Guégniaud of the Fortinet Product Security team.
• Workaround. Fortinet says restricting access to TCP port 27918 prevents the issue. There is no FortiGuard virtual patch.
• KEV. The CVE is not in the CISA KEV catalog (catalog 2026.10.16). Fortinet's advisory says it is not known to be exploited.
• PoC. Horizon3's repository targets CVE-2026-106173 by name. Its README and blog describe the same gRPC service and port as Fortinet's advisory.

What is not confirmed

• Attacks. Neither Fortinet nor CISA reports exploitation in the wild. Exploitation status is Unknown.
• The PoC itself. Horizon3 says its code reaches command execution. ThreatWire has not tested this.
• Older branches. Whether 7.0 to 7.4 are truly affected is unclear. The CVE record says yes. The advisory table does not list them.
• Detection. Horizon3 says it found no application logs that clearly show exploitation. It suggests checking modified timestamps on scripts that cron runs.

What to do now

1. Upgrade FortiSIEM 7.5.0 to 7.5.1 or above.
2. If you run 7.0 to 7.4, plan a move to a fixed release. The CVE record points to 7.6.0 or above.
3. If you cannot patch today, block TCP port 27918 from untrusted networks.
4. Review your FortiSIEM hosts for unexpected file changes. Follow the Horizon3 deep-dive for its indicators.

Track this bug in the ThreatWire PoC finder for CVE-2026-106173. See every Fortinet issue on the Fortinet vendor tracker, or browse the CVE tracker and actively exploited CVEs.

Sources: Fortinet PSIRT FG-IR-26-180, NVD, CVE.org, the CISA KEV catalog, the Horizon3 deep-dive and the Horizon3 PoC repository. Links are in the references list.