Researchers publish FortiSIEM exploit proof of concept

Horizon3.ai released a proof-of-concept exploit for CVE-2026-106173 in Fortinet FortiSIEM. Fortinet had patched the issue the previous week and said FortiSIEM 7.5.0 users should move to 7.5.1 or later, while FortiSIEM 7.6 was listed as unaffected.

Horizon3.ai said the flaw affected a gRPC service listening on TCP port 27918. According to the company, an unauthenticated attacker could use it to write beyond the intended directory and turn that into remote code execution.

The firm said the problem came from unsafe handling of a user-supplied query-id value in SendQueryResult(). It said path traversal sequences could be inserted, and a null byte could cause the operating system to stop reading the rest of the path.

Horizon3.ai said the appended file name could then be ignored when the path reached the file-opening function. Zach Hanley said one version of the attack would overwrite an existing file in place, while another could create a new file with an exact name.

The example target in the report was a shell script used for Redis health checks and run every 60 seconds by cron. The article said the overwrite would preserve the existing owner and permissions.