Public exploit released for critical FortiSIEM remote code execution flaw

Security researchers have published a working proof-of-concept exploit for a critical vulnerability in Fortinet’s FortiSIEM platform. The flaw, tracked as CVE-2026-106173, allows unauthenticated attackers to execute arbitrary code on affected systems. Fortinet released patches for the issue last week, urging administrators to update immediately.

What happened

The vulnerability carries a CVSS score of 9.4, indicating a severe risk to enterprise environments. It is a path traversal flaw that enables an attacker to write files to unauthorized locations on the server’s file system. By combining this file-write capability with specific system configurations, an attacker can achieve remote code execution without needing valid credentials.

Horizon3.ai detailed the technical mechanics of the exploit. The issue resides in the gRPC service, which listens on TCP port 27918. The service processes metadata from incoming requests without properly validating the file paths. An attacker can send specially crafted packets containing directory traversal sequences, such as "../", to escape the intended directory and target sensitive system files.

The exploit leverages a second weakness involving null-byte injection. While the application appends its own filename suffix to any written file, embedding a null byte ("\0") in the request causes the operating system to ignore everything after that character. This allows the attacker to specify the exact filename and path, effectively overwriting existing scripts or creating new malicious ones.

Key details

• Vulnerability ID: CVE-2026-106173 with a CVSS score of 9.4.
• Affected versions: FortiSIEM 7.5.0 is vulnerable; users must upgrade to 7.5.1 or later.
• Unaffected versions: FortiSIEM 7.6 is not affected by this specific flaw.
• Attack vector: Unauthenticated access via the gRPC service on TCP port 27918.
• Exploit method: Path traversal combined with null-byte injection in the "query-id" parameter.
• Target file: The proof-of-concept overwrites /opt/charting/redishb.sh, a Redis health-check script executed by cron every 60 seconds.

Background

FortiSIEM is a security information and event management tool used by organizations to monitor network activity and detect threats. Like many enterprise tools, it relies on background services to maintain system health and process data. One such service is a cron job, a time-based scheduler in Unix-like operating systems that runs scripts at fixed intervals.

In this case, the system runs a shell script named redishb.sh every minute to check the status of the Redis database service. Because this script runs with elevated privileges and on a predictable schedule, it becomes an ideal target for attackers. If an attacker can overwrite this script with malicious code, the system will execute that code automatically within minutes, granting the attacker full control over the server.

The use of gRPC, a high-performance remote procedure call framework, adds complexity to the attack surface. gRPC uses HTTP/2 for transport, which supports advanced features like HPACK header compression. The exploit takes advantage of how these layers handle metadata, allowing the attacker to inject harmful characters that bypass standard validation checks.

Why it matters

For teams running self-hosted security infrastructure, this incident highlights the danger of unauthenticated services exposed on internal networks. Even if a service is not directly accessible from the internet, lateral movement within a network can allow attackers to reach ports like 27918. Once inside, the lack of authentication means there are no barriers to sending malicious packets.

The reliance on cron jobs for system maintenance creates a predictable execution window. Attackers know exactly when their malicious code will run, reducing the uncertainty typically associated with exploitation. This predictability makes the vulnerability particularly dangerous, as it transforms a file-write error into a reliable remote code execution vector.

Furthermore, the public release of a proof-of-concept exploit significantly increases the risk. Automated scanning tools and threat actors will likely begin probing for unpatched instances immediately. Organizations that delay patching leave themselves open to rapid compromise, potentially losing visibility into their own security events if the SIEM itself is compromised.

What you can do

• Upgrade FortiSIEM 7.5.0 installations to version 7.5.1 or higher immediately.
• Verify that FortiSIEM 7.6 deployments are up to date, though they are not affected by this specific CVE.
• Restrict network access to TCP port 27918 using firewalls or security groups, allowing only trusted management IPs.
• Monitor system logs for unexpected modifications to files in /opt/charting/ or other critical directories.
• Review cron job configurations to ensure scripts are protected against unauthorized writes and have strict permissions.
• Implement network segmentation to limit lateral movement, ensuring that compromised endpoints cannot easily reach management interfaces.