Unauthenticated gRPC path traversal to arbitrary file write and RCE in Fortinet FortiSIEM (CVE-2026-106173)
horizon3.ai published a working proof-of-concept repository and a technical deep-dive on 2026-10-20 for this unauthenticated RCE, so any FortiSIEM 7.5.0 (or older 7.x) supervisor with port 27918 reachable is now exposed to copy-paste exploitation; no attacks are confirmed.
A path traversal in FortiSIEM's phQueryMaster gRPC service (tcp port 27918) lets an unauthenticated attacker write arbitrary files with specially crafted packets, which horizon3.ai has chained to remote code execution on the appliance. No credentials or non-default configuration are needed; the exploit is a single network request sequence against the exposed port.
Affected: Fortinet FortiSIEM 7.5.0 (fixed in 7.5.1); Fortinet FortiSIEM 7.4.0 – 7.4.2; Fortinet FortiSIEM 7.3.0 – 7.3.5; Fortinet FortiSIEM 7.2.0 – 7.2.7; Fortinet FortiSIEM 7.1.0 – 7.1.9; Fortinet FortiSIEM 7.0.0 – 7.0.4; Not affected: FortiSIEM 7.6 and FortiSIEM Cloud
How to Test
Check the FortiSIEM supervisor/worker version in the admin UI or the appliance's version output: 7.5.0 and the 7.0–7.4 branches listed above are affected; 7.6 and FortiSIEM Cloud are not. Confirm from outside your network whether tcp port 27918 (the phQueryMaster gRPC service) is reachable by anything other than trusted FortiSIEM nodes. For signs of compromise, review network records for connections to port 27918 from unexpected sources, noting that horizon3.ai found no application logs that explicitly reveal exploitation and look for unexpected or recently modified files in writable locations on the appliance, since the flaw is an arbitrary file write that is then used for code execution.
How to Patch
Upgrade FortiSIEM 7.5.0 to 7.5.1 or later (FG-IR-26-180). For the affected 7.0–7.4 branches, Fortinet's advisory names no fixed build beyond the 7.5.1 line; until you can move to a fixed release, apply the vendor workaround: restrict access to tcp port 27918 so only trusted FortiSIEM components can reach it. FortiSIEM Cloud requires no action.