CVE-2026-106173

No known exploitation. EPSS puts it in the 39th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile39th0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-10-13Updated 2026-10-21Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Fortinet FortiSIEMAffected: 7.5.0Upgrade to: not statedAffected: ≥ 7.4.0, ≤ 7.4.2Upgrade to: after 7.4.2Affected: ≥ 7.3.0, ≤ 7.3.5Upgrade to: after 7.3.5Affected: ≥ 7.2.0, ≤ 7.2.7Upgrade to: after 7.2.7 + 2 more branchesStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your organization runs FortiSIEM, specifically version 7.5.0.
Confirm the system is reachable from the internet or an internal network an attacker could reach.
Upgrade to FortiSIEM 7.5.1 or above (or 7.6.0 or above) as soon as possible.
If you use FortiSIEMCloud or FortiSOC, upgrade to FortiSIEMCloud 25.4.1+ or FortiSOC 26.2.2+ respectively.
Until patched, restrict network access to the FortiSIEM management interfaces to trusted IPs only.

Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

2 publishers

Researchers published a public proof-of-concept exploit for a critical path traversal vulnerability in Fortinet FortiSIEM that enables unauthenticated remote code execution.
as reported · Oct 20, 2026·The Hacker News summary
Vendor patch released
as reported · Oct 14, 2026·SecurityWeek summary

Sourced from public security reporting — each date is when it was published, not when it happened. 1 further article named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

In plain language

Written by AI from the record

A critical flaw in Fortinet FortiSIEM 7.5.0 lets an attacker break into the system over the network without a password and potentially take full control, so if you run this version you should treat it as urgent.

Unauthenticated path traversal (CWE-22) in Fortinet FortiSIEM 7.5.0 allows an attacker to send crafted network packets that escape restricted directories to read, write, or overwrite files, enabling arbitrary code execution.

If you're affected

Full system takeover
Security monitoring blind spot
Log and alert data exposure
Entry point for further network attacks

What is it

FortiSIEM is a security monitoring tool many businesses rely on to watch for threats across their network, like a security camera system for your IT environment. This flaw is like a hidden gap in that camera system's control room door — someone outside could walk in without a badge and tamper with the equipment, potentially disabling the very tool meant to protect you.

Who is affected

This matters to you if you run Fortinet FortiSIEM, specifically version 7.5.0. It also affects related products: FortiSIEMCloud and FortiSOC should be checked against the vendor's fixed versions. No login or user action is needed for an attacker to exploit this if the system is reachable over the network.

How urgent is it

This is a critical, unauthenticated flaw that lets an attacker fully compromise a security monitoring system with no login and no user interaction required, so it needs immediate attention. While there is no confirmed report yet of attackers actively using this flaw, its severity, ease of exploitation, and the sensitivity of what FortiSIEM monitors mean you should not wait for an incident before patching. Treat this as a top-priority fix this week, not a routine update.

What to do — in detail

Confirm exposure by inventorying all FortiSIEM, FortiSIEMCloud, and FortiSOC instances and checking their exact version numbers, paying special attention to any FortiSIEM 7.5.0 deployment. Target fixed versions: FortiSIEM 7.5.1 or above (or 7.6.0 or above for the next major branch), FortiSIEMCloud 25.4.1 or above, and FortiSOC 26.2.2 or above. Review vendor upgrade notes for breaking changes before upgrading production instances. There is no documented workaround from the vendor beyond upgrading; if an immediate upgrade is not possible, restrict network-level access to FortiSIEM's listening services (e.g., via firewall ACLs or VPN-only access) to reduce exposure to the path traversal vector. No CISA KEV listing or confirmed in-the-wild exploitation exists at this time, and no public exploit code has been identified, but given the unauthenticated, network-reachable nature of the flaw and its CVSS 9.8 severity, monitor vendor advisories and FortiSIEM logs for anomalous file access or unexpected process execution following upgrade.

Technical context

CVSS 3.1 score 9.8 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting unauthenticated network-based attack with no complexity and full impact to confidentiality, integrity, and availability. Weakness is CWE-22 (path traversal) exploited via specially crafted packets that allow file read/write/create outside restricted directories, potentially leading to remote code execution. Not currently listed in CISA KEV; no dated news confirming in-the-wild exploitation; no public exploit code is known to exist. Predictive exploitation likelihood sits in the mid-low percentile and trend is flat, indicating no near-term exploitation signal yet, though this should not be relied on given the severity and ease of the attack path. Exploit maturity is currently theoretical/PoC-absent, but the default-reachable, pre-auth nature of the flaw makes it a high-value target once technical details or exploit code surface.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS39th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 39th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

16 events over 9 days, from the signal feeds we watch.

2026-10-22OpenVAS check added
2026-10-21Patch availablerecord updated
2026-10-20Patch availablerecord updated
2026-10-14Patch availablepatch available, patch available, record updated, record updated, record updated
2026-10-13Patch availablepublished, weakness classified, att&ck mapped, record updated

Affected products

Fortinetcommercial · USaka forti net
- FortiSIEMSecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable