Critical FortiSIEM RCE Vulnerability Exploited in Public Proof-of-Concept
Researchers at Horizon3.ai have released a public proof-of-concept (PoC) exploit for CVE-2026-106173, a critical unauthenticated remote code execution (RCE) vulnerability in Fortinet FortiSIEM. The flaw, disclosed in Fortinet’s October 13 security advisory, allows attackers to convert arbitrary file writes into full system compromise without credentials.
The vulnerability resides in FortiSIEM’s gRPC communication service, specifically the phQueryMaster component running on TCP port 27918. Unlike previous FortiSIEM exploits targeting phMonitor (TCP 7900), this attack leverages a misconfigured SendQueryResult RPC handler that fails to validate file paths. Attackers can inject directory traversal sequences into the query identifier, enabling them to overwrite files outside the intended directory.
A key discovery by researcher Zach Hanley revealed that the exploit preserves null bytes in attacker-supplied metadata, allowing precise file targeting. This bypasses the application’s filename generation typically incorporating source addresses and timestamps and lets attackers overwrite existing files while retaining original permissions. The researchers demonstrated RCE by hijacking /opt/charting/redishb.sh, a Redis health-check script executed every 60 seconds via cron, granting attackers persistent command execution under the service’s administrative context.
The PoC, published on GitHub on October 20, confirms the exploit’s feasibility but does not indicate active in-the-wild attacks. Horizon3.ai found no definitive logs of exploitation, though defenders are advised to inspect modification timestamps and contents of redishb.sh and /opt/phoenix/bin/phLicenseTool for unauthorized changes.
Fortinet’s advisory (FG-IR-26-180) identifies FortiSIEM 7.5.0 as affected and recommends upgrading to version 7.5.1 or later. Organizations are urged to apply patches and restrict access to the vulnerable service while remediation is underway.
Source: https://gbhackers.com/critical-fortinet-fortisiem-rce-vulnerability/
Fortinet TPRM report: https://www.rankiteo.com/company/fortinet
"id": "for1792578359",
"linkid": "fortinet",
"type": "Vulnerability",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Organizations using FortiSIEM '
'7.5.0',
'industry': 'Cybersecurity',
'name': 'Fortinet',
'type': 'Vendor'}],
'attack_vector': 'Unauthenticated gRPC service (phQueryMaster on TCP port '
'27918)',
'customer_advisories': 'Organizations using FortiSIEM 7.5.0 should apply '
'patches and inspect critical files for unauthorized '
'changes.',
'date_publicly_disclosed': '2026-10-13',
'description': 'Researchers at Horizon3.ai have released a public '
'proof-of-concept (PoC) exploit for CVE-2026-106173, a '
'critical unauthenticated remote code execution (RCE) '
'vulnerability in Fortinet FortiSIEM. The flaw allows '
'attackers to convert arbitrary file writes into full system '
'compromise without credentials by exploiting a misconfigured '
'gRPC communication service (phQueryMaster on TCP port 27918). '
'The PoC demonstrates RCE by hijacking a Redis health-check '
'script executed via cron, granting persistent command '
'execution under administrative context.',
'impact': {'operational_impact': 'Full system compromise, persistent command '
'execution under administrative context',
'systems_affected': 'FortiSIEM 7.5.0'},
'investigation_status': 'PoC released; no confirmed in-the-wild exploitation '
'detected',
'post_incident_analysis': {'corrective_actions': 'Patch vulnerability, '
'validate file paths in gRPC '
'handlers, and implement '
'stricter permission '
'controls for critical '
'system files.',
'root_causes': 'Misconfigured SendQueryResult RPC '
'handler in phQueryMaster (gRPC '
'service) failing to validate file '
'paths, allowing directory '
'traversal and arbitrary file '
'writes with preserved '
'permissions.'},
'recommendations': 'Apply patches immediately, restrict access to vulnerable '
'services, monitor for unauthorized file modifications, '
'and upgrade to FortiSIEM 7.5.1 or later.',
'references': [{'date_accessed': '2026-10-20',
'source': 'Horizon3.ai GitHub PoC',
'url': 'https://github.com/horizon3ai/CVE-2026-106173-PoC'},
{'date_accessed': '2026-10-13',
'source': 'Fortinet Security Advisory (FG-IR-26-180)'}],
'response': {'communication_strategy': 'Fortinet security advisory '
'(FG-IR-26-180)',
'containment_measures': 'Restrict access to vulnerable service '
'(TCP port 27918), inspect modification '
'timestamps of critical files (e.g., '
'redishb.sh, phLicenseTool)',
'enhanced_monitoring': 'Inspect logs for unauthorized changes to '
'critical files',
'remediation_measures': 'Upgrade to FortiSIEM 7.5.1 or later',
'third_party_assistance': 'Horizon3.ai (research and PoC '
'development)'},
'stakeholder_advisories': 'Fortinet customers advised to upgrade and restrict '
'access to vulnerable services.',
'title': 'Critical FortiSIEM RCE Vulnerability Exploited in Public '
'Proof-of-Concept',
'type': 'Remote Code Execution (RCE)',
'vulnerability_exploited': 'CVE-2026-106173'}