Fortinet's FG-IR-26-180, published on 13 October 2026, fixes CVE-2026-106173 in FortiSIEM. Fortinet titles it an arbitrary file write in the gRPC phQueryMaster service and describes a path traversal (CWE-22) that may let an unauthenticated attacker execute unauthorised code or commands with specially crafted packets. It rates the flaw Critical, 9.4 (CVSS 3.1). Only FortiSIEM 7.5.0 is listed as affected; 7.6 is not affected and FortiSIEM Cloud is not affected.

The fix is 7.5.1. Fortinet gives a workaround: restricting access to TCP port 27918 prevents the issue. The flaw was found internally by Fortinet's product security team, and the advisory marks it as not known to be exploited. FortiSIEM collects logs and credentials for the systems it monitors and is widely run by managed security providers, and older FortiSIEM bugs have been exploited soon after disclosure, so a SIEM that accepts traffic from untrusted networks is worth treating as urgent.

Released in the same Fortinet monthly batch as the critical FortiSandbox flaw CVE-2026-107656 (its own card).

UPDATE (20 Oct, Horizon3.ai): Horizon3.ai published a technical analysis and released working exploit code on GitHub. It found the phQueryMaster gRPC service on TCP 27918 listens on all interfaces and does not ask clients for a certificate, so anyone who can reach the port can call it without logging in. Its SendQueryResult handler builds a file path from an attacker-supplied query-id without validation, so '../' sequences pick the directory, and a NUL byte in the query-id cuts off the file name the server would otherwise append, letting an attacker overwrite an existing file in place while keeping its owner and permissions.

Horizon3.ai's exploit overwrites /opt/charting/redishb.sh, a Redis health-check script cron runs every 60 seconds, which turns the file write into code execution; a second variant creates a new file with an exact name.

Horizon3.ai says no FortiSIEM application log clearly shows the attack. Fortinet's advisory still marks the flaw as not known to be exploited (checked 21 Oct). Wire: The Hacker News (20 Oct).