CYBUNKR

FortiSIEM flaw now has public exploit code

Published

CVE-2026-106173 in Fortinet FortiSIEM 7.5.0, rated 9.4, lets an attacker run commands without logging in. Working exploit code has been public since 20 October and one threat feed reports exploitation. What to update, block and ask your provider.

Your SIEM is the system meant to spot attackers, so it shouldn't be the way in. Fortinet's advisory FG-IR-26-180 says a path traversal flaw in the FortiSIEM gRPC service, CVE-2026-106173, may let an unauthenticated attacker run code or commands with specially crafted packets. Fortinet rates it critical, 9.4 out of 10 (CVSS v3.1). It published the fix on 13 October; a week later, working exploit code was on GitHub.

Who is affected

  • FortiSIEM 7.5.0. Fortinet says to upgrade to 7.5.1 or above. It lists FortiSIEM 7.6 as not affected and says FortiSIEM Cloud is not affected (FG-IR-26-180).
  • Older releases: the advisory only lists 7.5 and 7.6, but the CVE record Fortinet filed also lists 7.0 to 7.4 releases as affected. If you run one of those, ask Fortinet support which release fixes it.
  • Run by your provider? Many smaller organisations get FortiSIEM as part of a managed security service rather than running it themselves. If yours does, the server may belong to your provider, so the questions below are for them.

What has been seen so far

A snapshot from 27 October:

  • Horizon3.ai published a proof-of-concept exploit on 20 October. Its README says it runs a chosen command on FortiSIEM over the gRPC port, 27918 by default, by overwriting a script that a scheduled job then runs within about 60 seconds.
  • CISA's assessment in the CVE record rates exploitation as “proof of concept”, automatable, with “total” technical impact.
  • CIRCL's Vulnerability-Lookup has logged more exploit code for it posted between 22 and 25 October, and its catalogue carries an entry from the Previdian feed reporting successful exploitation on 23 October, which Previdian gives a confidence of 0.70.
  • Fortinet's advisory marked it “Known Exploited: No” when published, and CISA had not added it to its Known Exploited Vulnerabilities catalog by 27 October.

Unverified exploit code is sometimes laced with malware, so don't run copies of it to test your own systems.

What to do

  • Upgrade FortiSIEM 7.5.0 to 7.5.1 or later, or move to 7.6 (Fortinet).
  • Block TCP port 27918 from anywhere that doesn't need it. Fortinet says restricting access to that port prevents the issue, and it should never be reachable from the internet.
  • If a provider runs it, ask them which FortiSIEM version they run, whether it is on 7.5.1 or later, whether port 27918 is reachable from outside, and whether they have checked it for compromise since 20 October.
  • Look back to 20 October: the public exploit works by overwriting a file that a scheduled job runs, so check FortiSIEM for unexpected file changes, new processes and unusual outbound connections from at least that date.

How we can help

If you think your FortiSIEM has been accessed, our Incident Response service can help, or get in touch.

Sources