Skip to content
Critical RCE Vulnerability in FortiSIEM Disclosed

Critical RCE Vulnerability in FortiSIEM Disclosed

First seen 20 Oct 2026, 15:52 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 16:14 UTC
  • •CVE-2026-106173 allows unauthenticated RCE via FortiSIEM's gRPC service.
  • •The vulnerability has a CVSS score of 9.4, classified as critical.
  • •A proof of concept for exploitation has been publicly released.

On October 13, 2026, Fortinet published an advisory for CVE-2026-106173, a critical remote code execution vulnerability in FortiSIEM. This flaw allows unauthenticated attackers to write arbitrary files by exploiting a gRPC service on port tcp/27918. The vulnerability arises from improper path validation in the SendQueryResult handler, enabling directory traversal through crafted metadata. A proof of concept has been released, demonstrating exploitation via path traversal and NUL-byte injection. The CVSS score for this vulnerability is 9.4, indicating its critical nature. Administrators are urged to assess their systems and apply patches as soon as possible. The vulnerability is currently not confirmed to be in the wild, but the existence of a public exploit raises concerns.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2023-10-10
CVE-2023-34992 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-13
Fortinet publishes advisory for CVE-2026-106173
Fortinet disclosed a critical RCE vulnerability in FortiSIEM affecting gRPC services.
Horizon3.Ai
2026-10-20
Proof of concept for CVE-2026-106173 released
A repository with a proof of concept for exploiting the vulnerability was made available, detailing exploitation methods.
Sploitus

More articles in this cluster (2)

Following this threat?

Track CVE-2023-34992 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (9)

1 / 4

Common questions

What is CVE-2026-106173?
CVE-2026-106173 is a critical remote code execution vulnerability in FortiSIEM that allows unauthenticated file writes.
How can I protect my systems?
Administrators should apply the latest patches from Fortinet and monitor for any unusual activity.
Is there a known exploit in the wild?
Currently, there is no confirmed active exploitation in the wild, but a proof of concept is publicly available.