Public PoC targets critical unauthenticated FortiSIEM RCE flaw
Security researchers have released a public proof-of-concept exploit for CVE-2026-106173, a critical Fortinet FortiSIEM vulnerability with a CVSS score of 9.4. The flaw can allow an unauthenticated attacker to execute unauthorized code or commands through specially crafted packets.
Fortinet issued patches last week. FortiSIEM 7.5.0 deployments should be upgraded to version 7.5.1 or later, while the vendor lists FortiSIEM 7.6 as not affected. The availability of a public PoC makes patch prioritisation more urgent for organisations operating the affected release.
gRPC handler lacks adequate path validation
Horizon3.ai said the vulnerable component is a gRPC service listening on TCP port 27918. Its QueryResultReq handler processes untrusted metadata and can be abused to write a file outside the intended directory. Researchers traced the issue to unsafe path construction in the SendQueryResult() function, where a user-controlled query-id value is passed without sufficient validation.
An attacker can include directory-traversal sequences such as ../ in that parameter to escape the expected directory. On its own, this behaviour does not provide complete control of the target filename: the application appends a filename in the form result-<source IP address>-0-0-<id>.dat, with the counter controlled by the server.
NUL-byte injection enables precise overwrites
The exploit chain uses a second weakness. A NUL byte embedded in the query-id parameter can make the operating system treat the value as a terminated string when it reaches the file-opening function. Content appended after that byte, including the application-generated filename suffix, is then ignored.
Horizon3.ai demonstrated a crafted value pointing to ../../../../../opt/charting/redishb.sh, followed by a NUL byte. That script performs Redis health checks and is executed by a cron job every 60 seconds. Overwriting an existing file preserves its owner and permissions, the researchers said, while a two-request variant can create a new file with an exact name.
What security teams should do
The issue is particularly significant because the attack begins without authentication and targets a network service. Organisations running FortiSIEM 7.5.0 should identify reachable instances, upgrade to 7.5.1 or later, and review whether TCP port 27918 is exposed beyond the systems that require it.
Teams should also examine file-integrity signals and cron-executed scripts on FortiSIEM systems for unexpected changes. The practical business implication is clear: treating the published PoC as a prioritised patching and exposure-review task can reduce the opportunity for unauthenticated code execution on affected appliances.