Recently, cybersecurity experts unveiled a proof-of-concept (PoC) exploit for a significant security flaw in Fortinet’s FortiSIEM software. This flaw, identified as CVE-2026-106173 with a critical CVSS score of 9.4, poses severe risks by potentially allowing arbitrary code execution through unauthorized access.
Details of the FortiSIEM Vulnerability
This vulnerability is categorized as a path traversal weakness. An attacker, without authentication, could exploit this flaw by sending specially crafted packets to execute unauthorized code or commands. Fortinet has already issued patches for this flaw, advising users to upgrade to FortiSIEM version 7.5.1 or higher, while version 7.6 remains unaffected.
Horizon3.ai researchers highlighted that the flaw allows unauthenticated users to connect through the gRPC service on TCP port 27918. By exploiting unsafe path construction, attackers can overwrite files outside the intended directories, transforming the arbitrary-file-write capability into a potential remote code execution scenario.
Technical Exploitation and Impact
The vulnerability originates from the improper processing of untrusted metadata by the FortiSIEM gRPC QueryResultReq handler. Attackers can craft metadata with path traversal sequences and NUL-byte injections within the gRPC’s HTTP/2 and HPACK encoding layers, enabling arbitrary file writes.
The flaw is rooted in the SendQueryResult() function, which inadequately validates user-supplied parameters. This oversight allows attackers to navigate directories and write to a chosen location, though file naming remains restricted as the program appends its own file name format.
Exploiting the Flaw for Code Execution
Further exploitation is possible by embedding a null byte within the “query-id” parameter, causing the system to disregard subsequent characters. This technique allows an attacker to overwrite specific files, such as a shell script for Redis health checks executed regularly by a cron job.
Zach Hanley, Chief Attack Engineer at Horizon3.ai, explained that the vulnerability enables overwriting existing files without altering original permissions. Moreover, a variant technique allows creation of new files with precise names through sequential requests.
The disclosure of this vulnerability underscores the critical need for timely patch management and highlights the ongoing challenges in securing complex software systems. Organizations using FortiSIEM are urged to implement the recommended updates to safeguard their networks against potential exploits.
