FortiSIEM
CVE-2026-106173: FortiSIEM path traversal allows unauthenticated code execution
A path traversal in FortiSIEM 7.5.0's phQueryMaster service lets an unauthenticated attacker run code with crafted packets (CVSS 9.4). Fortinet says it is not exploited and found it internally; no public PoC is confirmed.
Published Updated Fortinet advisory FG-IR-26-180
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiSIEM 7.5.0 | 7.5.1 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
FortiSIEM’s phQueryMaster gRPC service has a path traversal flaw (CWE-22) that lets an unauthenticated attacker run code or commands by sending specially crafted packets. The attack is network-based and needs no privileges or user interaction. Fortinet rates it critical, CVSS 9.4.
Fortinet’s Product Security team found it internally. The advisory says it is not known to be exploited, and CISA had not added it to the KEV catalog as of catalog 2026.10.16. EPSS is low (0.4%, 36th percentile, 2026-10-16). No source confirms a public proof of concept. CISA’s SSVC data in the CVE record rates it automatable with total technical impact, so a working exploit would be easy to run at scale.
A SIEM holds logs and credentials from across your environment, which makes it a valuable target.
Am I affected?
Per Fortinet’s advisory, only FortiSIEM 7.5.0 is affected. Fortinet lists FortiSIEM 7.6 and FortiSIEM Cloud as not affected. The advisory names no required configuration. Exposure depends on whether an attacker can reach TCP port 27918.
The sources disagree. The CVE record also lists FortiSIEM 7.4.0 to 7.4.2, 7.3.0 to 7.3.5, 7.2.0 to 7.2.7, 7.1.0 to 7.1.9 and 7.0.0 to 7.0.4 as affected, with no fixed versions for them. The advisory is Fortinet’s own statement and lists only 7.5.0, so this page follows it. If you run an older branch, ask Fortinet which is right, and plan an upgrade anyway.
What to do
- Upgrade FortiSIEM 7.5.0 to 7.5.1 or later. The CVE record also lists 7.6.0 or later as fixed.
- If you can’t upgrade tonight, restrict access to TCP port 27918. Fortinet’s advisory gives this as the workaround. Allow the port only from FortiSIEM nodes that need it and block everything else. Check your deployment’s dependencies on this port first.
- On an older branch (7.0 to 7.4), confirm with Fortinet whether you are affected, and restrict port 27918 in the meantime.
- If the port was reachable from untrusted networks, check for compromise (below). If you find signs of it, rebuild the node and rotate credentials the SIEM stores, such as device and integration accounts.
Detection
Fortinet’s advisory lists no indicators of compromise and no log signatures. What you can do:
- Review firewall and flow logs for connections to TCP 27918 from addresses that are not FortiSIEM nodes.
- Look for unexpected files or processes on the FortiSIEM node.
- Watch for outbound connections from the FortiSIEM node to unfamiliar hosts.
Indicators of compromise
Checked the Fortinet advisory, which lists no indicators. No exploitation has been reported, so none are expected.
No indicators of compromise have been published for this CVE yet. We'll add them here if the vendor or a researcher releases any. Until then, use the behaviour in Detection.
Sources
Page changelog
- Full analysis published.
KEV status, EPSS score and vendor data refreshed automatically, last on 18 Oct 2026.