Researchers have released a proof-of-concept exploit for a critical path traversal vulnerability (CVE-2026-106173, CVSS score 9.4) impacting FortiSIEM, allowing unauthenticated attackers to execute unauthorized code or commands.
The vulnerability or weakness
The vulnerability stems from unsafe path construction within the SendQueryResult() function, which passes a user-supplied 'query-id' parameter directly without sufficient validation, enabling directory traversal and file writing.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-106173 | 9.8 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Researchers Warn OpenCode Quietly Patched Critical RCE Flaw, Leaving Users At Risk (2026-10-20)
- ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (2026-10-20) - The Hacker News
- Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers (2026-10-19)
Business impact
Organizations using FortiSIEM are at risk of unauthorized code execution, potentially leading to data breaches, system compromise, and operational disruptions.
Industries affected
This vulnerability affects organizations in various sectors, including IT, financial services, and healthcare, which rely on FortiSIEM for security monitoring and management.
Users affected
Customers using FortiSIEM versions 7.5.0 and below are affected, as the vulnerability allows unauthenticated attackers to exploit the gRPC service to write arbitrary files to the system, posing a significant threat to their security.
