Critical FortiSIEM Vulnerability Exposed via Public Proof-of-Concept Exploit
Unauthenticated remote code execution risk emerges following release of new exploit PoC.
1Critical Security Flaw Identified
A critical path traversal vulnerability, tracked as CVE-2026-106173, impacts Fortinet FortiSIEM systems. With a CVSS score of 9.4, this flaw allows unauthenticated attackers to execute unauthorized code. Researchers at Horizon3.ai recently released a proof-of-concept exploit, highlighting the urgent need for administrators to apply the patches released by Fortinet last week.
2Exploiting the gRPC Service
The vulnerability resides within the gRPC service listening on TCP port 27918. Attackers connect to this service and send specially crafted packets to trigger the flaw. The system fails to validate untrusted metadata, enabling attackers to manipulate file paths and overwrite existing files on the underlying file system through HTTP/2 encoding layers.
3Unsafe Path Construction Mechanism
The issue originates from the SendQueryResult function, which processes a user-supplied query-id parameter without sufficient validation. While the application typically appends a specific suffix to file names, the lack of sanitization allows directory traversal sequences like ../ to escape intended directories, setting the stage for unauthorized file system write operations.
4Null-Byte Injection Technique
Attackers leverage a null-byte injection to bypass file naming constraints. By embedding a null byte in the query-id parameter, the operating system interprets it as a string terminator. This causes the system to ignore the automatically appended file name suffix, allowing the attacker to control the exact destination and name of the file.
5Executing Arbitrary Shell Scripts
By targeting specific paths, such as the redishb.sh script located in the opt/charting directory, attackers can overwrite critical files. This script is executed every 60 seconds by a cron job to perform Redis health checks. Overwriting this file allows the attacker to achieve remote code execution with the permissions of the original file owner.
6Maintaining File Permissions Integrity
Zach Hanley, Chief Attack Engineer at Horizon3.ai, notes that the exploit overwrites files in place. This method preserves the original owner and file permissions, which helps attackers maintain stealth. Alternatively, attackers can use two separate requests to create entirely new files with precise names, further expanding their control over the compromised system.
7Immediate Patching Requirements
Fortinet has already released patches to address this critical vulnerability. Organizations currently running affected versions of FortiSIEM must prioritize these updates to mitigate the risk of remote code execution. Failure to patch leaves the gRPC service exposed to unauthenticated attackers who can now utilize the publicly available proof-of-concept exploit code.
8Broader Security Operations Context
This incident underscores the importance of rigorous input validation in gRPC services and metadata processing. As AI agents and automated systems gain deeper access to sensitive data, security teams must strengthen attack surface visibility. Proactive threat readiness and strict control over permissions remain essential to preventing breaches from emerging vulnerabilities in infrastructure.