Key points
- Fortinet released patches for CVE-2026-106173 on October 13, 2026.
- The flaw allows unauthenticated remote code execution via a gRPC service.
- Attackers can write arbitrary files by exploiting path traversal and null bytes.
Fortinet released security updates on October 13, 2026, to address a critical vulnerability in its FortiSIEM security information and event management platform. The flaw, identified as CVE-2026-106173, carries a CVSS score of 9.4. According to The Hacker News, patches were released last week by Fortinet. This update resolves a severe risk that allows attackers to execute code remotely without any login credentials.
In plain English
The vulnerability exists in a specific service called phQueryMaster, which listens on TCP port 27918. Horizon3.ai researchers found that this gRPC service does not require client certificates or authentication. An attacker can connect directly to this port from the internet. The service processes data using a function named SendQueryResult. This function fails to validate input properly, allowing malicious manipulation of file paths on the server.
The background
Horizon3.ai detailed how the exploit works in a deep-dive report. Attackers use path traversal sequences to move outside the intended directory. They also inject null bytes into the query-id parameter. This tricks the operating system into ignoring the server’s automatic filename suffix. As a result, attackers can overwrite existing system files with arbitrary data. This arbitrary file write capability leads to remote code execution.
What changes now
A proof-of-concept exploit for this flaw has been made public, according to The Hacker News. Fortinet’s advisory confirms the issue is patched. Organizations running FortiSIEM must apply the latest updates immediately. Delaying the patch leaves the gRPC service exposed to unauthenticated attacks.
Who needs to act first
Teams usually prioritize systems exposed to the internet or internal networks with high lateral movement risk. Check whether your FortiSIEM instances are reachable on port 27918. If exposure exists, isolate the system from untrusted networks while preparing the update. Back up configuration data before applying patches to ensure recovery options. Test the update in a non-production environment first to verify stability. Monitor logs for unusual file write activity during the transition.
What to do and how to stay safe: Fortinet
- Verify if your FortiSIEM version is listed in Fortinet's advisory for CVE-2026-106173.
- Apply the latest security patch provided by Fortinet as soon as possible.
- Restrict access to TCP port 27918 using firewalls if the service is not needed externally.
- Monitor system logs for unauthorized file modifications or unexpected process executions.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-106173?
It is a critical path traversal vulnerability in Fortinet FortiSIEM that allows unauthenticated remote code execution via a gRPC service.
Is there a fix available?
Yes, Fortinet released patches for the vulnerability on October 13, 2026, according to The Hacker News.
How do attackers exploit this flaw?
Attackers connect to the unauthenticated gRPC service on port 27918 and use path traversal with null bytes to overwrite system files.
