Summary Points
- PoC exploit for CVE-2026-106173 (CVSS 9.4) enables unauthenticated remote code execution on FortiSIEM 7.5.0.
- Attackers target gRPC on TCP/27918, combining path traversal and NUL-byte injection to overwrite arbitrary files.
- A demonstrated target is a Redis health-check script run by cron every 60 seconds, enabling recurring code execution.
Threat, Attack Techniques, and Targets
Threat: Researchers released a public proof of concept for FortiSIEM flaw CVE 2026 106173, which has a CVSS score of 9.4. The flaw could let an unauthenticated attacker run code or commands.
Attack method: An attacker can send crafted packets to the gRPC service on TCP port 27918. The exploit uses path traversal sequences and a null byte to write files outside the intended directory. Researchers say an attacker could then overwrite a shell script that a cron job runs every 60 seconds, leading to remote code execution.
Targets: FortiSIEM 7.5.0 is affected. FortiSIEM 7.6 is not affected.
Impact, Security Implications, and Remediation
Impact: Successful exploitation could allow an attacker to write arbitrary files and execute unauthorized code. Because the flaw does not require authentication, exposed affected systems face serious risk.
Remediation: Fortinet advises customers using FortiSIEM 7.5.0 to upgrade to version 7.5.1 or later. Also, consult Fortinet for current guidance on applying the update and protecting affected systems.
Stay Ahead with the Latest Tech Trends
Explore the future of technology with our detailed insights on Artificial Intelligence.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
