Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution

Researchers at Horizon3.ai have published a working proof-of-concept exploit for CVE-2026-106173, a critical path traversal vulnerability in Fortinet FortiSIEM rated 9.4 on the CVSS scale. The flaw lets an unauthenticated attacker connect to the product's gRPC service on TCP port 27918 and abuse unsanitized query-id metadata to write files outside the intended directory, ultimately achieving remote code execution. By combining directory traversal sequences with a null-byte injection trick, an attacker can overwrite a sensitive Redis health-check shell script that runs via cron, giving them a path to full system compromise. Fortinet shipped fixes last week, with FortiSIEM 7.5.0 users urged to upgrade to 7.5.1 or later, while the 7.6 branch is not affected.