CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE
Executive Summary
In October 2026, Fortinet disclosed CVE-2026-106173, a critical path traversal vulnerability in FortiSIEM (CVSS 9.4) affecting versions up to 7.5.0. Unauthenticated attackers can connect to the gRPC service on TCP port 27918, exploit unsafe path construction in the SendQueryResult() function, and chain a null-byte injection technique to overwrite arbitrary files—including a Redis health-check shell script executed every 60 seconds by a cron job—achieving full unauthenticated remote code execution. Horizon3.ai published a public proof-of-concept exploit within days of patching, dramatically lowering the bar for exploitation across all unpatched FortiSIEM deployments.
The public release of a working PoC transforms this from a theoretical risk into an active, weaponizable threat. Security operations platforms like FortiSIEM are high-value targets because compromising them can blind defenders, disrupt incident response, and provide attackers with privileged visibility into an organization's entire security telemetry—amplifying blast radius far beyond a typical application breach.
Why This Matters Now
With a CVSS 9.4-rated PoC now publicly available, any unpatched FortiSIEM instance is immediately exploitable by low-sophistication attackers. Compromising a SIEM platform eliminates defender visibility at the worst possible moment—during an active intrusion—and FortiSIEM 7.5.0 remains widely deployed in enterprise and government environments that may lag on patching cycles.
Attack Path Analysis
An unauthenticated attacker exploited CVE-2026-106173, a critical path traversal and null-byte injection flaw in FortiSIEM's gRPC service on TCP port 27918, to overwrite a privileged shell script executed by a cron job, achieving unauthenticated remote code execution without any credential requirement. From that initial foothold, the attacker gained root-level execution context, enabling lateral movement across monitored infrastructure, establishment of command-and-control channels, potential data exfiltration of SIEM-collected logs and credentials, and ultimately disruption of security visibility across the enterprise.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An unauthenticated attacker sent specially crafted gRPC packets to the FortiSIEM QueryResultReq handler on TCP port 27918. By embedding path traversal sequences (../) and null-byte injection within the query-id parameter, the attacker exploited CVE-2026-106173 to write arbitrary content to a privileged file path (e.g., /opt/charting/redishb.sh), a shell script executed every 60 seconds by a cron job, achieving unauthenticated remote code execution without valid credentials.
Related CVEs
CVE-2026-106173
CVSS 9.8A critical path traversal vulnerability in Fortinet FortiSIEM's gRPC QueryResultReq handler allows an unauthenticated remote attacker to write arbitrary files outside the intended directory via specially crafted packets containing path traversal sequences and null-byte injection, ultimately enabling unauthenticated remote code execution.
Affected Products:
Fortinet FortiSIEM – 7.5.0 (upgrade to 7.5.1 or above required), 7.6 (not affected)
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Command and Scripting Interpreter: Unix Shell
Exploitation for Client Execution
Server Software Component: Web Shell
Hijack Execution Flow: ServicesFile Permissions Weakness
Masquerading: Match Legitimate Name or Location
File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification
Scheduled Task/Job: Cron
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Timely Patching of Known Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Unauthenticated Access Prevention and Incident Response Planning
Control ID: Section 500.7 — Access Privileges and Section 500.16 — Incident Response
DORA (Digital Operational Resilience Act) – ICT Vulnerability Management and Incident Response for Financial Entities
Control ID: Article 9 — ICT Security Policies and Article 10 — ICT-Related Incident Management
NIS2 Directive – Vulnerability Handling, Patch Management, and Supply Chain Security
Control ID: Article 21 — Cybersecurity Risk Management Measures
CISA ZTMM 2.0 (Zero Trust Maturity Model) – Least-Privilege Network Access and Workload Isolation
Control ID: Networks Pillar — Network Segmentation and Micro-Segmentation; Application and Workload Pillar — Application Access
ISO/IEC 27001:2022 – Technical Vulnerability Management and Secure Network Configuration
Control ID: Annex A 8.8 — Management of Technical Vulnerabilities and Annex A 8.20 — Networks Security
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
FortiSIEM CVE-2026-106173 unauthenticated RCE via gRPC path traversal directly threatens IT security operations, exposing SIEM infrastructure to lateral movement, command-and-control compromise, and undetected exfiltration across managed environments.
Computer/Network Security
Public PoC exploit for FortiSIEM critically undermines security operations centers relying on SIEM visibility; zero trust segmentation and egress controls mapped to NIST.800-53.SC-7 and PCI.4.0 become immediately essential mitigations.
Financial Services
PCI.4.0 and NIST compliance obligations make financial institutions high-risk targets; FortiSIEM RCE exploitation could disable threat detection pipelines, enabling silent lateral movement and data exfiltration across regulated payment environments.
Health Care / Life Sciences
HIPAA.164.312 and HIPAA.164.308 compliance requirements combined with sensitive patient data make healthcare SIEM compromise via CVE-2026-106173 a critical risk enabling undetected exfiltration and privilege escalation across clinical networks.
Sources
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Executionhttps://thehackernews.com/2026/10/critical-fortisiem-flaw-gets-public.htmlVerified
- CVE-2026-106173 Deep Dive: FortiSIEM gRPC Path Traversal File Write RCEhttps://horizon3.ai/attack-research/cve-2026-106173-deep-dive-fortisiem-grpc-path-traversal-file-write-rce/Verified
- Horizon3.ai GitHub PoC for CVE-2026-106173https://github.com/horizon3ai/CVE-2026-106173Verified
- Fortinet Product Security Incident Response Team (PSIRT) Advisorieshttps://www.fortiguard.com/psirtVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker exploited unauthenticated access to a gRPC service exposed across the network, then leveraged the SIEM's trusted network posture to move laterally and exfiltrate data. By enforcing workload-level segmentation and restricting east-west and egress paths, Aviatrix would likely reduce the attacker's reachability to the vulnerable service and constrain the blast radius following initial compromise.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Network-level segmentation enforced through the CNSF fabric would likely reduce the population of hosts that could reach TCP port 27918 on the FortiSIEM appliance, constraining the attacker's ability to deliver the malicious gRPC payload from arbitrary source workloads or external network segments.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what a compromised FortiSIEM process could communicate with post-exploitation, meaning even if privilege escalation succeeded internally, the elevated execution context would find its outbound and lateral reach restricted to explicitly permitted paths rather than the broad network access the SIEM typically holds.
Control: East-West Traffic Security
Mitigation: East-west traffic inspection and enforcement would likely reduce the attacker's ability to freely pivot from the compromised FortiSIEM host to adjacent infrastructure, as lateral connection attempts to workloads and segments outside the SIEM's explicitly defined monitoring paths would likely be identified and constrained before reaching target assets.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and traffic control across network paths would likely surface anomalous outbound connection patterns from the FortiSIEM host, reducing the attacker's ability to sustain a covert command-and-control channel by making unexpected destination addresses and tunneling behaviors visible against the baseline of legitimate monitoring traffic.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress enforcement would likely constrain the attacker's ability to transfer bulk SIEM-collected data to external destinations, reducing the volume and reach of potential exfiltration by limiting outbound paths from the FortiSIEM host to only sanctioned endpoints and protocols rather than allowing arbitrary outbound data transfers.
Even where direct CNSF control over internal FortiSIEM processes is limited, the earlier reduction in lateral movement paths and egress options would likely constrain the attacker's ability to spread destructive payloads or suppression actions broadly across the monitored environment, keeping the impact more localized to the compromised SIEM host rather than propagating enterprise-wide.
Impact at a Glance
Affected Business Functions
- Security Information and Event Management (SIEM) Operations
- Security Operations Center (SOC) Monitoring and Alerting
- Enterprise Log Aggregation and Compliance Reporting
- Incident Detection and Response Infrastructure
Estimated downtime: 7 days
Estimated loss: N/A
Exploitation of this vulnerability via unauthenticated remote code execution on FortiSIEM infrastructure could expose highly sensitive security telemetry including aggregated log data from across the enterprise, network topology details, authentication event records, threat detection rules and configurations, and potentially credentials or API keys stored within the SIEM environment. A compromised SIEM platform may also enable an attacker to suppress or manipulate security alerts, blind the SOC to concurrent intrusion activity, and facilitate lateral movement across monitored infrastructure. The null-byte file overwrite primitive targeting cron-executed shell scripts (e.g., redishb.sh) provides persistent code execution capability, significantly elevating the risk of prolonged undetected compromise.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata-based) signatures targeting CVE-2026-106173 exploit patterns — specifically gRPC traffic on TCP port 27918 containing path traversal sequences (../) and null-byte injection — to detect and block exploit attempts before they reach the FortiSIEM gRPC service.
- • Apply Zero Trust Segmentation to restrict access to FortiSIEM management interfaces (including TCP port 27918) exclusively to authorized management hosts using identity-based SmartGroup policies, ensuring the gRPC service is never reachable from untrusted networks or unauthenticated sources.
- • Enforce Egress Security & Policy Enforcement with FQDN-based outbound filtering on the FortiSIEM host to prevent reverse shell establishment and C2 beacon traffic, blocking all unauthorized outbound destinations and flagging anomalous egress patterns inconsistent with SIEM operational baselines.
- • Enable Multicloud Visibility & Control to baseline normal FortiSIEM traffic patterns and trigger anomaly alerts on deviations such as unexpected outbound connections, unusual file write activity, or gRPC traffic from external IPs — providing early detection of exploitation attempts and post-compromise C2 activity.
- • Enforce East-West Traffic Security controls to monitor and restrict FortiSIEM's lateral access to monitored infrastructure, ensuring that even if the SIEM host is compromised, microsegmentation policies prevent the attacker from pivoting to adjacent workloads, firewalls, or cloud environments using harvested credentials.
