CVE-2026-106173: FortiSIEM gRPC Path Traversal RCE (pending)

CVE-2026-106173 is a path traversal flaw in FortiSIEM's gRPC phQueryMaster service that lets an unauthenticated attacker write arbitrary files anywhere on the filesystem, and researchers at Horizon3 have published a public proof-of-concept that overwrites a script executed by cron every 60 seconds to achieve remote code execution; NVD has not finished analyzing the CVE and it is not yet on the CISA KEV catalog, so this page stays noindex pending that confirmation.

CVE-2026-106173 is a path traversal vulnerability (CWE-22) in the gRPC-based phQueryMaster service of Fortinet FortiSIEM, which listens on TCP port 27918 across every network interface. Fortinet's own PSIRT advisory FG-IR-26-180 states the issue "may allow attacker to execute unauthorized code or commands via specially crafted packets" and credits internal discovery to Gwendal Guégniaud of the Fortinet Product Security team (Fortinet PSIRT Advisory FG-IR-26-180).

Fortinet's advisory does not go into exploitation mechanics, but Horizon3.ai's technical deep-dive — published a week after the advisory, with a working proof of concept — does: the SendQueryResult RPC accepts an attacker-controlled query-id field that is embedded in a server-side filename without sanitizing directory-traversal sequences or embedded null bytes, so "any remote client can connect" without a client certificate and write arbitrary data to an arbitrary path. Horizon3 demonstrates turning that write primitive into code execution by overwriting /opt/charting/redishb.sh, a script FortiSIEM's own cron job re-executes every 60 seconds (Horizon3.ai: CVE-2026-106173 Deep Dive).

NVD's record for CVE-2026-106173 carries the status "Awaiting Analysis" as of 2026-10-28: it lists only a Secondary CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) submitted by the Fortinet CNA, with no NVD-published Primary score and no NVD CPE applicability statement yet, so this page leaves cvss_score unset rather than presenting the vendor figure as NVD-confirmed (NVD).

Fortinet's advisory does not report any known exploitation in the wild, and this CVE is not present in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-28, despite the public PoC (CISA KEV). FIRST scores the probability of exploitation at 0.01 (62.6th percentile) as of the same date (FIRST EPSS).

Fortinet's fix is to upgrade to FortiSIEM 7.5.1 or later; until patched, restricting network access to TCP port 27918 removes the unauthenticated attack path without requiring an upgrade. Because a public, fully-detailed PoC now exists for an unauthenticated file-write-to-RCE chain, affected FortiSIEM 7.5.0 deployments should be treated as high priority to patch or firewall even though NVD analysis and KEV listing are still pending.

• Path traversal in FortiSIEM's gRPC phQueryMaster service may allow an attacker to execute unauthorized code or commands via specially crafted packets; internally discovered by Fortinet's Gwendal Guégniaud. — Fortinet PSIRT Advisory FG-IR-26-180
• The SendQueryResult gRPC RPC on TCP/27918 accepts an unauthenticated, unsanitized query-id used to build a server-side filename; a public PoC traverses directories and overwrites /opt/charting/redishb.sh, a script re-run by cron every 60 seconds, to achieve code execution. — Horizon3.ai: CVE-2026-106173 Deep Dive
• NVD status is "Awaiting Analysis" with only a Fortinet CNA Secondary CVSS v3.1 score of 9.8 on record as of 2026-10-28; no NVD Primary score or CPE configuration published. Affects FortiSIEM 7.0.0-7.5.0, fixed in 7.5.1; 7.6 and FortiSIEM Cloud are not affected. — NVD
• Not present in the CISA KEV catalog as of 2026-10-28, despite a public proof-of-concept. — CISA KEV
• EPSS score is 0.01 (62.6th percentile) as of 2026-10-28. — FIRST EPSS