FortiSIEM Flaw CVE-2026-106173 Exploited in the Wild After PoC and Details Go Public
Do Son 
TL;DR
Canada’s Cyber Centre updated its Fortinet advisory on October 23, 2026, to warn that CVE-2026-106173 “is being exploited in the wild.” This FortiSIEM vulnerability, rated CVSS 9.4, lets unauthenticated attackers write files and run code. Horizon3 has already published full technical details and a public proof-of-concept exploit.
- CVE: CVE-2026-106173
- CVSS: 9.8 (Critical · CVSSv3)
- Product: Fortinet FortiSIEM
- Affected: 7.5.0, 7.4.0, 7.3.0, 7.2.0, 7.1.0, 7.0.0
- Impact: CWE-22
- Status: Exploited in the wild
- EPSS: 1.0% (30-day)
- Action: See vendor advisory
Why It Matters
FortiSIEM collects security data across entire networks. Taking it over gives attackers a view of everything defenders see. Moreover, with exploit code public, the bar for attacks is low.
Exploited in the wild, with public PoC
The Canadian Cyber Centre advisory AV26-1037 cites open-source reporting of active exploitation. Meanwhile, Horizon3 released its CVE-2026-106173 proof-of-concept on GitHub after a detailed write-up. CISA’s enrichment of the CVE record also rates the flaw as automatable. However, CISA has not yet added it to its KEV catalog. Fortinet’s own team found the flaw internally, and its advisory carries an “E:H” exploit maturity rating, meaning functional exploit code exists for this FortiSIEM vulnerability.
How the Attack Works
The bug sits in the gRPC service of the phQueryMaster daemon. That service handles metadata “without proper path validation.” As a result, an attacker can steer a file write outside its intended folder. Overwriting the right file then leads to code execution. According to Horizon3, no application logs reveal the attack. Instead, defenders must look for odd file timestamps.
Affected Versions
The Fortinet PSIRT advisory FG-IR-26-180 lists FortiSIEM 7.5.0 as affected and 7.5.1 as fixed. FortiSIEM 7.6 and FortiSIEM Cloud are not affected. Note that the public CVE record also lists older branches, from 7.0.0 through 7.4.2.
Patch and Mitigation Steps
- Upgrade FortiSIEM 7.5 to 7.5.1 or later.
- Restrict access to TCP port 27918. Fortinet says this “prevents the issue.”
- Check scheduled scripts for unexpected file changes.
Given active attacks and a public exploit, admins should patch this FortiSIEM vulnerability immediately.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
